CVE-2026-2975 FastApiAdmin Custom Documentation Endpoint init_app.py reset_api_docs information disclosure
Remote attackers can access sensitive information via the custom documentation endpoint in FastApiAdmin, requiring immediate upgrade.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-2975?
CVE-2026-2975 is a medium-severity vulnerability in FastApiAdmin, published on 23 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A security flaw has been discovered in FastApiAdmin up to 2.2.0. Affected by this vulnerability is the function reset_api_docs of the file /backend/app/plugin/init_app.py of the component Custom Documentation Endpoint. The manipulation results in information disclosure. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Which versions are affected by CVE-2026-2975?
It affects 1 product.
Products include Fastapiadmin Fastapiadmin.
How do I fix CVE-2026-2975?
No fix has been published for CVE-2026-2975 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-2975 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-2975 exists.
Other vulnerabilities in FastApiAdmin
- CVE-2026-2976 FastApiAdmin Download Endpoint controller.py download_controller information disclosure
- CVE-2026-2977 FastApiAdmin Scheduled Task API controller.py upload_controller unrestricted upload
- CVE-2026-2978 FastApiAdmin Scheduled Task API controller.py upload_file_controller unrestricted upload
- CVE-2026-2979 FastApiAdmin Scheduled Task API controller.py user_avatar_upload_controller unrestricted upload
Sources
Also known as GHSA-h4v7-f6v2-4hmm.