# CVE-2026-36724: FastapiAdmin uncaught exception in job update endpoint

Source: https://junglewise.ai/threats/cve-2026-36724-fastapiadmin-uncaught-exception-in-job-update-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-36724 · Severity: info · Published 2026-06-09

FastapiAdmin is an administrative dashboard framework used to manage web applications. A flaw in how the system handles scheduled task updates allows a user with specific permissions to crash the application. This results in a denial-of-service, preventing legitimate administrators from accessing the management interface and disrupting automated background tasks.

Technologies: [FastAPI Admin](https://junglewise.ai/threats/technologies/fastapi-admin). Vendors: [FastAPI Admin](https://junglewise.ai/threats/vendors/fastapi-admin).

## Quick answers

**Is CVE-2026-36724 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-36724 being exploited in the wild.

**How severe is CVE-2026-36724?** Informational severity, published 9 June 2026.

**Which products and versions are affected?** FastAPI Admin 2.2.0.

**Is there a fix for CVE-2026-36724?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-36724 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-36724?** Check whether you run FastAPI Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Denial of Service (DoS) vulnerability exists in FastapiAdmin v2.2.0 due to improper exception handling in the job update endpoint. Specifically, the '/application/job/update/{id}' endpoint fails to catch exceptions when a user modifies the 'func' field of a scheduled task. An authenticated attacker possessing the 'module_task:job:update' permission can provide malformed or unexpected input to this field, triggering an uncaught exception that crashes the service. This is a network-reachable vulnerability requiring valid credentials with specific administrative privileges.

## Affected products

- FastapiAdmin FastapiAdmin 2.2.0

## Timeline

- 2026-06-09: disclosed
- 2026-06-09: advisory

## References

- [https://github.com/CC-T-454455/Vulnerabilities/tree/master/fastapi-admin/vulnerability-8](https://github.com/CC-T-454455/Vulnerabilities/tree/master/fastapi-admin/vulnerability-8)

## Related threats

- [PYSEC-2026-1356 - FastAPI Admin cross-site scripting (XSS) vulnerability in the Create Product function](https://junglewise.ai/threats/cve-2024-42816-fastapi-admin-cross-site-scripting-in-product-creation)
- [FastapiAdmin stored XSS in AI assistant chat](https://junglewise.ai/threats/cve-2026-36728-fastapiadmin-stored-xss-in-ai-assistant-chat)
- [FastapiAdmin stored XSS in system notice creation](https://junglewise.ai/threats/cve-2026-36725-fastapiadmin-stored-xss-in-system-notice-creation)