Executive brief
starlette-admin is an administrative interface framework for FastAPI and Starlette applications. Versions 0.16.1 through 0.17.1 contain a flaw that allows authenticated users to bypass field-level access controls and filter on database columns that administrators intended to keep hidden from search, potentially exposing sensitive data through the API's filtering mechanism.
Technical details
The vulnerability is an authorization bypass in the searchable_fields allowlist enforcement. When searchable_fields is configured as an empty list (intended to disable searching entirely), the framework fails to properly validate filter parameters submitted via the list API's where parameter. Authenticated attackers can craft structured filter queries to perform equality and comparison operations on excluded columns, circumventing the intended access control. This is a post-authentication vulnerability requiring valid credentials to exploit. No patch information is indicated in the advisory, though the issue affects versions 0.16.1 through 0.17.1.
Affected products
- jowilf starlette-admin 0.16.1 through 0.17.1
Timeline
- 2026-09-12: disclosed