Executive brief
Starlette-Admin is a web-based administrative interface for the Starlette web framework. An authenticated administrator can craft malicious requests to sort or filter data by fields that should not be accessible, potentially exposing sensitive information from hidden columns. Additionally, attackers can trigger application crashes (HTTP 500 errors) by submitting invalid field names, causing temporary service disruptions for legitimate users.
Technical details
The vulnerability stems from a client-side enforcement flaw (CWE-602) where the administrative UI restricts available sortable and filterable fields, but the backend API accepts and processes arbitrary field names without validation against the configured allowlist. An authenticated attacker can submit requests with field names not intended to be searchable or sortable, bypassing access controls. Additionally, supplying special Python attribute names (e.g., `metadata`, `__class__`) or other invalid field identifiers triggers unhandled exceptions in the ORM query processing, resulting in HTTP 500 responses and denial of service. The fix validates incoming `order_by` and search parameters against the configured field whitelist before processing.
Affected products
- jowilf Starlette-Admin <= 0.16.0
Timeline
- 2026-06-20: disclosed: Published in GitHub Advisory Database
- 2026-06-20: patched: Version 0.16.1 released
- 2026-08-26: advisory: GitHub Reviewed and published to advisory database