CVE-2026-89267: starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-12 · updated 2026-09-23
Weakness: CWE-863

Description

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality and comparison operations on excluded columns.

Affected products

jowilf starlette-admin: from 0.16.1 through 0.17.1

References

https://github.com/jowilf/starlette-admin
https://github.com/jowilf/starlette-admin/blob/0.17.1/starlette_admin/views.py#L971-L987
https://www.vulncheck.com/advisories/starlette-admin-0.16.1-through-0.17.1-searchable-fields-allowlist-bypass

Get alerted when CVE-2026-89267 or the next vulnerability affects your stack