CVE-2026-54553: Starlette admin Denial of Service Vulnerability
MODERATECVE-2026-54553 is a MODERATE (CVSS 5.4) denial of service vulnerability (CWE-639: Authorization Bypass Through User-Controlled Key) affecting Starlette admin libraries in the PyPI ecosystem. The issue involves starlette-admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and http 500 dos. Remediation is available by upgrading affected packages to version 0.16.1.
CVE-2026-54553 at a Glance
Security Impact
CVSS: 5.4
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L).
How to Fix CVE-2026-54553
To remediate this vulnerability, upgrade all affected Starlette admin dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
pip install starlette-admin>=0.16.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
pip show starlette-adminHow to Check if You Are Affected
To determine whether your Python environment is affected by CVE-2026-54553, inspect your installed packages using pip:
pip show starlette-adminAnalyze the terminal output to locate any version of Starlette admin in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.16.1), your application is affected.
Note: The pip show starlette-admin command checks currently installed packages in your active Python environment.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key, where the system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. In Starlette admin, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-54553 Affected Starlette admin Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
starlette-admin
|
PyPI |
< 0.16.1
|
0.16.1
|
References
Frequently Asked Questions
What is CVE-2026-54553?
Which Starlette admin versions are affected?
What version fixes CVE-2026-54553?
Is starlette-admin affected?
What is the CVSS score of CVE-2026-54553?
What CWE is associated with CVE-2026-54553?
How can I check PyPI dependencies for CVE-2026-54553?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-6753-gr46-6wpr",
"modified" : "2026-08-26T14:14:37Z",
"published" : "2026-08-26T14:14:37Z",
"aliases" : [ "CVE-2026-54553" ],
"summary" : "Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS",
"details" : "## Summary\n\nAffected versions of Starlette-Admin prior to 0.16.1 do not properly validate user-supplied sort and search parameters against the configured field allowlists. While the administrative UI restricts available fields based on field configuration, the backend accepts arbitrary field names supplied through API requests.\n\nAn authenticated user can submit crafted requests to sort or filter records using fields that are not intended to be searchable or sortable. Additionally, supplying invalid field names or special Python attribute names can trigger unhandled exceptions that result in HTTP 500 responses.\n\n## Impact\n\nAn authenticated user with access to affected list endpoints may:\n\n* Bypass intended UI restrictions and perform sorting or filtering on fields that are not configured as searchable or sortable.\n* Cause affected API requests to fail with HTTP 500 responses by supplying invalid field names or special Python attribute names such as `metadata` or `__class__`.\n\nThis vulnerability may result in unauthorized use of query functionality and limited denial-of-service conditions affecting the targeted endpoint.\n\n## Affected Versions\n\nAll versions before 0.16.1.\n\n## Patched Versions\n\n* 0.16.1\n\n## Workarounds\n\nThere are no known workarounds. Users should upgrade to version 0.16.1 or later.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "PyPI",
"name" : "starlette-admin"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.16.1"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 0.16.0"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/jowilf/starlette-admin/security/advisories/GHSA-6753-gr46-6wpr"
}, {
"type" : "WEB",
"url" : "https://github.com/jowilf/starlette-admin/pull/776"
}, {
"type" : "WEB",
"url" : "https://github.com/jowilf/starlette-admin/commit/af05b45cd90944b726949fd650ab9d19f1abafc3"
}, {
"type" : "WEB",
"url" : "https://github.com/jowilf/starlette-admin/commit/d2a25ebbaf213d4c2cfc87187e34309ca6e30a51"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/jowilf/starlette-admin"
}, {
"type" : "WEB",
"url" : "https://github.com/jowilf/starlette-admin/releases/tag/0.16.1"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-200", "CWE-248", "CWE-602", "CWE-639" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-08-26T14:14:37Z",
"nvd_published_at" : null
}
}