Executive Summary

CVE-2026-2975 is a security flaw in FastApiAdmin versions up to 2.2.0, specifically in the function reset_api_docs within the file /backend/app/plugin/init_app.py of the Custom Documentation Endpoint component.

This vulnerability causes information disclosure by exposing API documentation endpoints such as the OpenAPI specification and documentation pages without any authentication or authorization controls.

As a result, unauthorized remote attackers can access sensitive metadata about the API, including endpoints, parameters, and data models, compromising confidentiality.

The exploit is publicly available, making it easier for attackers to leverage this flaw.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive information about the API, such as detailed metadata including endpoints, parameters, and data models.

Attackers can remotely exploit this flaw without any authentication, increasing the risk of targeted attacks or further exploitation.

While it does not directly affect the integrity or availability of the system, the confidentiality breach can facilitate other attacks or expose sensitive implementation details.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the FastApiAdmin instance exposes the API documentation endpoints such as /api/v1/docs, /api/v1/redoc, or the OpenAPI specification openapi.json without any authentication or authorization.

You can use network scanning or HTTP request commands to test access to these endpoints remotely.

• Use curl to check if the documentation endpoints are accessible without authentication, for example: curl -i http://<target-host>/api/v1/docs
• Similarly, test the OpenAPI JSON endpoint: curl -i http://<target-host>/openapi.json
• If these endpoints return detailed API metadata without requiring credentials, the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting or disabling API documentation endpoints in production environments.

Enforce authentication and authorization controls for accessing the documentation and OpenAPI routes to prevent unauthorized access.

Alternatively, limit access to these endpoints to trusted internal networks only.

If possible, consider replacing the affected FastApiAdmin version with an alternative or updated version that addresses this vulnerability.

Useful 0 Not Useful 0