CVE-2026-54553: 
Python vulnerability analysis and mitigation

CVE-2026-54553 is an improper server-side validation vulnerability in Starlette-Admin, an administrative interface framework for FastAPI and Starlette applications. The list API endpoint fails to validate user-supplied order_by and where field names against the configured sortable_fields and searchable_fields allowlists, allowing authenticated users to bypass UI-enforced restrictions. All versions prior to 0.16.1 are affected. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory).

The root cause lies in the _render_api method within starlette_admin/base.py and the BaseModelView validation path, which accepted arbitrary field names in order_by and structured where parameters without checking them against server-side allowlists (CWE-602, CWE-639). While the administrative UI restricts available fields based on configuration, the backend API did not enforce the same restrictions, constituting a classic client-side enforcement of server-side security flaw. Additionally, supplying invalid field names or special Python attribute names such as metadata or __class__ could trigger uncaught exceptions (CWE-248), resulting in HTTP 500 responses. The fix, implemented in PR #776, adds explicit validation calls _validate_order_by() and _validate_where() that check submitted field names against the sortable_fields and searchable_fields allowlists before processing, returning HTTP 422 on violations (GitHub Advisory, Fix PR #776).

An authenticated user with access to any affected list endpoint can sort or filter records on fields not intended to be sortable or searchable, potentially exposing sensitive data that administrators intended to restrict (CWE-200). This constitutes a limited information disclosure oracle — an attacker can infer the existence or values of hidden fields by observing query behavior. Additionally, submitting invalid or special Python attribute names causes unhandled exceptions and HTTP 500 responses, resulting in a limited denial-of-service condition for targeted API requests. There is no integrity impact, and exploitation is constrained to authenticated users (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported. The NVD SSVC assessment classifies exploitation as "none" and the vulnerability is not automatable, requiring authenticated access to a list endpoint. The EPSS score is 0.0, indicating very low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The reporter credited is "muslimbek-0x" (GitHub Advisory).

1. Authenticate: Obtain valid credentials for a Starlette-Admin instance running a version prior to 0.16.1 (i.e., ≤ 0.16.0).
2. Identify list endpoints: Browse or enumerate available admin list API endpoints, typically at /admin/api/<model-identity>.
3. Probe hidden fields via order_by: Send a crafted GET request with an arbitrary order_by parameter referencing a field not exposed in the UI, e.g., GET /admin/api/user?order_by=password asc. Observe whether the response returns sorted data or an error, inferring field existence.
4. Probe hidden fields via where filter: Send a crafted GET request with a JSON-encoded where parameter targeting a non-searchable field, e.g., GET /admin/api/user?where={"secret_token":{"eq":"abc"}}. Differences in result counts or data can reveal information about hidden field values.
5. Trigger DoS via special attribute names: Submit special Python attribute names such as metadata or __class__ in order_by or where to cause unhandled exceptions and HTTP 500 responses, disrupting access to the targeted endpoint for legitimate users (GitHub Advisory).

• Network: Unusual GET requests to /admin/api/<model> endpoints with order_by parameters containing field names not present in the standard UI, or where parameters with unexpected field names encoded as JSON.
• Logs: Web server or application logs showing repeated HTTP 500 responses from list API endpoints, particularly with order_by or where query parameters containing values like metadata, __class__, or other Python dunder attributes.
• Logs: HTTP 422 responses (after patching) from /admin/api/ endpoints indicating attempted exploitation of the validation bypass.
• Application: Patterns of authenticated API requests systematically varying field names in order_by or where parameters, suggesting automated probing of hidden fields (GitHub Advisory).

Upgrade starlette-admin to version 0.16.1 or later, which validates order_by and where field names against the configured sortable_fields and searchable_fields allowlists before processing, returning HTTP 422 for invalid inputs. The maintainer has confirmed there are no known workarounds for unpatched versions — upgrading is the only remediation. The fix was merged via PR #776 and released on August 26, 2026 (GitHub Advisory, Fix PR #776, Release 0.16.1).