CVE-2026-89267: starlette-admin Auth Bypass Vulnerability

CVE-2026-89267 Overview

CVE-2026-89267 affects starlette-admin versions 0.16.1 through 0.17.1, a Python admin interface library for Starlette and FastAPI applications. The vulnerability stems from improper enforcement of the searchable_fields allowlist when configured as an empty list. Authenticated users can bypass field-level filtering restrictions by submitting structured filter queries through the list API's where parameter. This lets attackers perform equality and comparison operations against columns that administrators intended to exclude from search. The flaw is classified under CWE-863: Incorrect Authorization.

Critical Impact
Authenticated users can enumerate sensitive column values on excluded fields, enabling information disclosure through inference-based queries against the backing database.

Affected Products

starlette-admin 0.16.1
starlette-admin versions 0.16.2 through 0.17.0
starlette-admin 0.17.1

Discovery Timeline

2026-09-12 - CVE-2026-89267 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-89267

Vulnerability Analysis

The starlette-admin library exposes a list API that accepts a where parameter for structured filtering. Administrators can restrict which columns are filterable by defining a searchable_fields allowlist on a model view. When this list is set to an empty value, the framework fails to treat the configuration as a deny-all rule. The filter handler instead skips allowlist enforcement entirely and forwards user-supplied field references to the underlying query builder.

This behavior contradicts the principal of least privilege that the allowlist mechanism is meant to enforce. Any authenticated user with access to the admin list endpoint can construct filter expressions targeting fields the developer explicitly wanted hidden from search. Refer to the VulnCheck advisory for the vendor analysis and the affected source lines for the exact validation logic.

Root Cause

The root cause is an authorization check that conflates an empty allowlist with an unconfigured allowlist. Instead of denying all field-level filtering when the list contains no entries, the code path permits every field to be queried. This is an authorization logic error rather than an input validation flaw.

Attack Vector

An attacker with valid admin panel credentials submits an HTTP request to the list endpoint of an affected model view. The request includes a where parameter containing structured JSON that references a non-searchable column and an operator such as equality, greater-than, or less-than. The server evaluates the filter and returns matching records. Repeated queries let the attacker infer the value of sensitive columns through binary search or equality probing. The vulnerability is described in prose because no public exploit code has been released.

Detection Methods for CVE-2026-89267

Indicators of Compromise

Repeated list API requests containing where parameters that reference the same field with varying comparison values, consistent with inference-based enumeration.
Filter payloads referencing model attributes that are not present in the application's declared searchable_fields configuration.
Elevated query volume from a single authenticated session against admin list endpoints.

Detection Strategies

Compare inbound where parameter contents against the server-side searchable_fields allowlist and log any references to excluded columns.
Instrument the SQLAlchemy or ORM layer to record filter predicates and correlate them with the admin session identifier.
Alert on statistically anomalous query patterns targeting sensitive columns such as password hashes, tokens, or personally identifiable information.

Monitoring Recommendations

Enable request-level logging on the starlette-admin list endpoints, including the full query string.
Retain admin panel access logs for correlation with database audit trails.
Monitor for admin accounts issuing high-cardinality filter queries within short time windows.

How to Mitigate CVE-2026-89267

Immediate Actions Required

Upgrade starlette-admin to a patched release that enforces the empty allowlist as a deny-all rule. Consult the project repository for the current fixed version.
Audit each ModelView subclass to confirm that searchable_fields is either populated with an explicit allowlist or that access to the admin panel is restricted to fully trusted users.
Review recent admin access logs for where-parameter queries targeting excluded columns.

Patch Information

The maintainers of starlette-admin have published fix guidance through the VulnCheck advisory. Administrators should track the project's release notes and pin dependencies to a version that enforces the allowlist correctly. The vulnerable code path resides in starlette_admin/views.py around the filter validation block.

Workarounds

Populate searchable_fields with the minimum required set of columns rather than leaving it empty, which restores the intended allowlist behavior.
Restrict admin panel access to a small set of trusted administrators using network-level controls or an authenticating reverse proxy.
Deploy a web application firewall rule that rejects where parameters referencing sensitive column names on affected endpoints.

bash

# Configuration example: pin to a patched release and define an explicit allowlist
pip install 'starlette-admin>0.17.1'

# In your ModelView subclass, define searchable_fields explicitly
# class UserView(ModelView):
#     searchable_fields = ["username", "email"]