Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality and comparison operations on excluded columns.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-12 | 2 | Disclosure1General1 |
| 2026-09-19 | 1 | Disclosure1 |
Εφαρμογές FastAPI: Νέα ευπάθεια στο starlette-admin https://www.secnews.gr/732590/efarmoges-fastapi-starlette-admin-cve-2026-89267/?fsp_sid=11863
Post summary
The text only announces a new vulnerability (CVE‑2026‑89267) in FastAPI’s starlette‑admin; no actionable details are presented.
CVE-2026-89267: Starlette-Admin 0.16.1-0.17.1 ignores empty searchable_fields allowlists, letting authenticated users query excluded columns via the where parameter. CVSS 4.3, patch status unknown. Audit https://www.valtersit.com/cve/CVE-2026-89267 #CVE #infosec #cybersecurity #cybersecurity #infosec #Microsoft #CVE #infosec #XSS #valtersit #snippet #infosec #SysAdmin #cybersecurity #Linux #devsecops #devops #developer #sysadmin #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecurity #cybersecuritynews #cybersecuritytips #python #hacker #linux #kali #ubuntu #debian #docker
Post summary
The tweet discloses CVE‑2026‑89267, describing how Starlette‑Admin versions 0.16.1‑0.17.1 ignore empty searchable_fields allowlists, enabling authenticated users to query excluded columns via the where parameter, and notes a CVSS 4.3 score with unknown patch status.
CVE-2026-89267 starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when configured as an empty list, allowing authenticated users to filte… https://www.cve.org/CVERecord?id=CVE-2026-89267
Post summary
The text discloses that starlette-admin versions 0.16.1 through 0.17.1 have a flaw where the searchable_fields allowlist is not enforced when empty, permitting authenticated users to manipulate filters.