Starlette Admin
Monthly
starlette-admin 0.16.1-0.17.1 exposes a column-level authorization bypass in its list API: when a developer explicitly configures searchable_fields as an empty list to prohibit field filtering entirely, the allowlist enforcement logic silently skips the check rather than denying all filter requests, allowing authenticated users to submit structured where predicates against any database column. This undermines a deliberate access-control decision by the application owner, potentially exposing sensitive column values that were intended to be hidden from the admin filter interface. No public exploit code has been identified and the vulnerability requires valid credentials (PR:L per CVSS 4.0 vector), limiting realistic exploitation to insiders or compromised accounts.
starlette-admin 0.16.1-0.17.1 exposes a column-level authorization bypass in its list API: when a developer explicitly configures searchable_fields as an empty list to prohibit field filtering entirely, the allowlist enforcement logic silently skips the check rather than denying all filter requests, allowing authenticated users to submit structured where predicates against any database column. This undermines a deliberate access-control decision by the application owner, potentially exposing sensitive column values that were intended to be hidden from the admin filter interface. No public exploit code has been identified and the vulnerability requires valid credentials (PR:L per CVSS 4.0 vector), limiting realistic exploitation to insiders or compromised accounts.