CVE-2026-89267
Received Received - Intake

Starlette-Admin Searchable Fields Bypass via Filter Query

Publication date: 2026-09-12

Last updated on: 2026-09-12

Assigner: VulnCheck

Description
starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality and comparison operations on excluded columns.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-12
Last Modified
2026-09-12
Generated
2026-09-12
AI Q&A
2026-09-12
EPSS Evaluated
N/A
NVD
CVE-2026-89267
EUVD
EUVD-2026-76772

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jowilf starlette-admin From 0.16.1 (inc) to 0.17.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects starlette-admin versions 0.16.1 through 0.17.1. When searchable_fields is set as an empty list, the system fails to enforce the allowlist. Authenticated users can submit filter queries via the where parameter to perform operations on non-searchable fields, potentially accessing or modifying unauthorized data.

Detection Guidance

To detect this vulnerability, inspect your starlette-admin application for versions between 0.16.1 and 0.17.1. Check if searchable_fields is configured as an empty list and verify if authenticated users can submit structured filter queries via the list API's where parameter. Review logs for unusual filter operations on non-searchable fields.

Impact Analysis

An attacker with authenticated access could exploit this to filter and retrieve data from restricted fields, leading to unauthorized information disclosure or manipulation. This could compromise sensitive data integrity and confidentiality in applications using the affected versions.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating principles of least privilege and data protection. It may result in non-compliance with GDPR (data protection), HIPAA (health data), or other regulations requiring strict access controls and auditability.

Mitigation Strategies

Immediately upgrade starlette-admin to a version beyond 0.17.1 where the vulnerability is patched. If upgrading is not possible, disable the where parameter in the list API or implement strict input validation to reject filter queries on non-searchable fields. Restrict authenticated user permissions to minimize potential impact.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89267. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart