Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-54553— Starlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

Quick assessment

Affected
jowilf starlette-admin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Starlette-Admin 是一个快速、美观且可扩展的行政接口框架，用于 FastAPI 和 Starlette 应用。在 0.16.1 版本之前，列表 API 未针对配置的 和 白名单对用户提供 的 和结构化 字段名进行校验。拥有受影响列表端点访问权限的已认证用户可以向 和 的验证路径提交任意字段名，从而绕过管理界面所施加的限制。请求可以基于那些本不应被允许排序或搜索的字段进行排序或过滤，导致有限的信息泄露。无效的字段名以及特殊的 Python 属性名（如 和类的双下划线属性）也可能引发未处理的异常和 HTT

CVSS 5.4 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
jowilf starlette-admin < 0.16.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54553

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Starlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS
Source: CVE Program / CVE List V5
Vulnerability Description
Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied order_by and structured where field names against the configured sortable_fields and searchable_fields allowlists. An authenticated user with access to an affected list endpoint can submit arbitrary field names to starlette_admin/base.py and the BaseModelView validation path, bypassing restrictions presented by the administrative user interface. Requests can sort or filter on fields that are not intended to be sortable or searchable, causing limited information exposure. Invalid field names and special Python attribute names such as metadata and the class dunder attribute can also trigger unhandled exceptions and HTTP 500 responses, causing limited denial of service for targeted requests. This issue is fixed in version 0.16.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
jowilf starlette-admin < 0.16.1 -

II. Public POCs for CVE-2026-54553

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54553

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54553 (5)

Vendor Advisories for CVE-2026-54553 (1)

Vendor Pages for CVE-2026-54553 (1)

IV. Related Vulnerabilities

Same weakness: CWE-200

V. Comments for CVE-2026-54553

No comments yet

Leave a comment