EUVD-2026-76772
GHSA-c9pv-p24c-23v6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible API requires low-privilege authentication; impact is read-only column data disclosure with no integrity, availability, or scope-change effects.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality and comparison operations on excluded columns.
AnalysisAI
starlette-admin 0.16.1-0.17.1 exposes a column-level authorization bypass in its list API: when a developer explicitly configures searchable_fields as an empty list to prohibit field filtering entirely, the allowlist enforcement logic silently skips the check rather than denying all filter requests, allowing authenticated users to submit structured where predicates against any database column. This undermines a deliberate access-control decision by the application owner, potentially exposing sensitive column values that were intended to be hidden from the admin filter interface. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two specific conditions: (1) the target application must configure searchable_fields as an empty Python list ([]) for the affected admin view - this is the exact edge case that bypasses the allowlist check; views with one or more named fields in searchable_fields are NOT affected; and (2) the attacker must hold valid credentials with at least low-privileged access to the starlette-admin interface (PR:L per CVSS 4.0). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N, score 5.3) accurately characterizes the impact: low confidentiality exposure, no integrity or availability impact, authenticated low-privilege access required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version is confirmed in the available data - the VulnCheck advisory and referenced source code identify only the vulnerable range (0.16.1-0.17.1) without citing a fixed release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today