Suggestions search

All statuses

Filter by:

With package: python313Packages.starlette-admin

Found 3 matching suggestions

View:

Compact

Detailed

Published

Permalink CVE-2026-89267

5.3 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 9 hours ago by @LeSuisse Activity log

Created suggestion 19 hours ago
@LeSuisse accepted 12 hours ago
@LeSuisse published on GitHub 9 hours ago

starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality and comparison operations on excluded columns.

References

Unenforced searchable_fields allowlist in _validate_where() at 0.17.1 technical-description
https://github.com/jowilf/starlette-admin product
VulnCheck Advisory: starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass third-party-advisory

Affected products

starlette-admin

=<0.17.1

Matching in nixpkgs

pkgs.python313Packages.starlette-admin

Fast, beautiful and extensible administrative interface framework for Starlette & FastApi applications

nixos-unstable 0.16.1
- nixpkgs-unstable 0.16.1
- nixos-unstable-small 0.17.1
nixos-26.05 0.16.0
- nixos-26.05-small 0.16.0
- nixpkgs-26.05-darwin 0.16.0

pkgs.python314Packages.starlette-admin

Fast, beautiful and extensible administrative interface framework for Starlette & FastApi applications

nixos-unstable 0.16.1
- nixpkgs-unstable 0.16.1
- nixos-unstable-small 0.17.1
nixos-26.05 0.16.0
- nixos-26.05-small 0.16.0
- nixpkgs-26.05-darwin 0.16.0

Package maintainers

@pbsds Peder Bergebakken Sundt <pbsds@hotmail.com>

Needs a backport to stable

Untriaged

Permalink CVE-2026-54553

5.4 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

created 2 weeks, 3 days ago Activity log

Created suggestion 2 weeks, 3 days ago

Starlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied order_by and structured where field names against the configured sortable_fields and searchable_fields allowlists. An authenticated user with access to an affected list endpoint can submit arbitrary field names to starlette_admin/base.py and the BaseModelView validation path, bypassing restrictions presented by the administrative user interface. Requests can sort or filter on fields that are not intended to be sortable or searchable, causing limited information exposure. Invalid field names and special Python attribute names such as metadata and the class dunder attribute can also trigger unhandled exceptions and HTTP 500 responses, causing limited denial of service for targeted requests. This issue is fixed in version 0.16.1.

References

https://github.com/jowilf/starlette-admin/security/advisories/GHSA-6753-gr46-6wpr x_refsource_CONFIRM
https://github.com/jowilf/starlette-admin/pull/776 x_refsource_MISC
https://github.com/jowilf/starlette-admin/commit/3d9639d12ffc30b0b92d45ad6aae5fefabc948f3 x_refsource_MISC
https://github.com/jowilf/starlette-admin/commit/57a1a76d45dfed16f580677303c5fd25220bd36b x_refsource_MISC
https://github.com/jowilf/starlette-admin/commit/af05b45cd90944b726949fd650ab9d19f1abafc3 x_refsource_MISC
https://github.com/jowilf/starlette-admin/commit/d2a25ebbaf213d4c2cfc87187e34309ca6e30a51 x_refsource_MISC
https://github.com/jowilf/starlette-admin/releases/tag/0.16.1 x_refsource_MISC

Affected products

starlette-admin

==< 0.16.1

Matching in nixpkgs

pkgs.python313Packages.starlette-admin

Fast, beautiful and extensible administrative interface framework for Starlette & FastApi applications

nixos-unstable 0.16.1
- nixpkgs-unstable 0.16.1
- nixos-unstable-small 0.17.1
nixos-26.05 0.16.0
- nixos-26.05-small 0.16.0
- nixpkgs-26.05-darwin 0.16.0

pkgs.python314Packages.starlette-admin

Fast, beautiful and extensible administrative interface framework for Starlette & FastApi applications

nixos-unstable 0.16.1
- nixpkgs-unstable 0.16.1
- nixos-unstable-small 0.17.1
nixos-26.05 0.16.0
- nixos-26.05-small 0.16.0
- nixpkgs-26.05-darwin 0.16.0

Package maintainers

@pbsds Peder Bergebakken Sundt <pbsds@hotmail.com>

Untriaged

Permalink CVE-2026-48710

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

created 3 months, 2 weeks ago Activity log

Created suggestion 3 months, 2 weeks ago

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.