Executive brief
SQLAdmin is a popular admin interface library for FastAPI and Starlette that provides database management features. The library's sort-by-column functionality fails to properly enforce security restrictions on which columns can be sorted, allowing an unauthenticated attacker to sort records by any hidden database field—including sensitive information like passwords or API keys. By observing how rows reorder when toggling sort direction, an attacker can deduce the values of hidden columns without directly reading them, potentially compromising customer data and application security.
Technical details
The vulnerability is an improper input validation flaw (CWE-20) in the sort_query() method. The sortBy query parameter is resolved directly via getattr() and passed to SQLAlchemy's order_by() without checking against column_sortable_list, which is only used for rendering UI links. An attacker with network access can craft requests with arbitrary column names—including dotted paths to related model fields—to trigger sorted result sets. Because row ordering reflects unexposed column values, this creates an information-exposure ordering oracle (CWE-200, CWE-639). Exploitation requires no authentication, user interaction, or special privileges; a single request leaks relative ordering, and asc↔desc toggling confirms secret values. The vulnerability is patched in version 0.27.1.
Affected products
- smithyhq sqladmin < 0.27.1
Timeline
- 2026-08-31: disclosed
- 2026-09-09: advisory
- 2026-09-09: patched: Version 0.27.1