Executive brief
FastapiAdmin is an administrative dashboard framework used to manage web applications. A flaw in how the system handles scheduled task updates allows a user with specific permissions to crash the application. This results in a denial-of-service, preventing legitimate administrators from accessing the management interface and disrupting automated background tasks.
Technical details
A Denial of Service (DoS) vulnerability exists in FastapiAdmin v2.2.0 due to improper exception handling in the job update endpoint. Specifically, the '/application/job/update/{id}' endpoint fails to catch exceptions when a user modifies the 'func' field of a scheduled task. An authenticated attacker possessing the 'module_task:job:update' permission can provide malformed or unexpected input to this field, triggering an uncaught exception that crashes the service. This is a network-reachable vulnerability requiring valid credentials with specific administrative privileges.
Affected products
- FastapiAdmin FastapiAdmin 2.2.0
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory