{"answers":{"affected":"3 open source packages ship an affected version, including starlette-admin.","exploited":"There is no known exploitation of CVE-2026-54553 in the wild and no public exploit code.","fix":"Upgrade starlette-admin to 0.16.1 or later.","what":"CVE-2026-54553 is a medium-severity vulnerability in jowilf starlette-admin, published on 26 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-54553 and fix it if it is affected.\n\nWhat it is: CVE-2026-54553 is a medium-severity vulnerability in jowilf starlette-admin, published on 26 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-54553 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- starlette-admin (PyPI): affected all versions; fixed in 0.16.1\n- starlette-admin (PyPI): affected all versions; fixed in 0.16.1\n- starlette-admin (PyPI): affected all versions; fixed in 0.16.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-54553/ (Markdown: https://insights.sbomify.com/CVE-2026-54553/index.md)","id":"CVE-2026-54553","markdown":"https://insights.sbomify.com/CVE-2026-54553/index.md","name":"CVE-2026-54553","record":{"aliases":["GHSA-6753-gr46-6wpr","PYSEC-2026-3924"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read","denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Python admin framework","requires_auth":"low_privilege","summary":"Authenticated users can bypass UI restrictions to expose hidden column data or cause denial of service via unvalidated order_by parameters in Starlette-Admin.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":5.4,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"cwes":[{"id":"CWE-639","name":"Authorization Bypass Through User-Controlled Key"},{"id":"CWE-248","name":"Uncaught Exception"},{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"description":"Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API does not validate user-supplied order_by and structured where field names against the configured sortable_fields and searchable_fields allowlists. An authenticated user with access to an affected list endpoint can submit arbitrary field names to starlette_admin/base.py and the BaseModelView validation path, bypassing restrictions presented by the administrative user interface. Requests can sort or filter on fields that are not intended to be sortable or searchable, causing limited information exposure. Invalid field names and special Python attribute names such as metadata and the class dunder attribute can also trigger unhandled exceptions and HTTP 500 responses, causing limited denial of service for targeted requests. This issue is fixed in version 0.16.1.","ecosystems":["PyPI"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS","id":"CVE-2026-54553","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":3,"n_references":7,"next":{"headline":"FOG adInfo endpoint is reported to disclose the Active Directory join password","id":"CVE-2026-54554"},"packages":[{"ecosystem":"PyPI","fixed":["0.16.1"],"introduced":["0"],"last_affected":[],"package":"starlette-admin","purl":null,"source":"GHSA-6753-gr46-6wpr"},{"ecosystem":"PyPI","fixed":["0.16.1"],"introduced":["0"],"last_affected":[],"package":"starlette-admin","purl":"pkg:pypi/starlette-admin","source":"GHSA-6753-gr46-6wpr"},{"ecosystem":"PyPI","fixed":["0.16.1"],"introduced":["0"],"last_affected":[],"package":"starlette-admin","purl":"pkg:pypi/starlette-admin","source":"PYSEC-2026-3924"}],"prev":{"headline":"sh _uid does not drop supplementary groups (incomplete privilege drop)","id":"CVE-2026-54552"},"products":["starlette-admin"],"published":"2026-08-26","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-26","vendors":["jowilf"]},"summary":"Authenticated users can bypass UI restrictions to expose hidden column data or cause denial of service via unvalidated order_by parameters in Starlette-Admin.","url":"https://insights.sbomify.com/CVE-2026-54553/"}