CVE-2026-36724: Medium severity pypi/fastapi-admin vulnerability
An uncaught exception in the /application/job/update/{id} endpoint of FastapiAdmin v2.2.0 allows authenticated attackers with the moduletask:job:update permission to cause a Denial of Service (DoS) via manipulating the func field of scheduled tasks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove or restrict the module_task:job:update permission from all accounts that do not require it; grant it only to trusted administrators until an official fix is released.
FastapiAdmin module_task:job:update permission = revoke or restrict to trusted administrators - Compensating control
Limit access to the /application/job/update/{id} endpoint (for example via firewall rules, IP allowlist, WAF, or reverse proxy) so only trusted IPs or internal networks can reach it until a patch is available.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have the module_task:job:update permission. The attack is network-reachable and does not require user interaction.
What impact can exploitation have?
Exploitation can cause a denial of service by triggering an uncaught exception through manipulation of the func field for scheduled tasks. The provided CVSS vector indicates no confidentiality or integrity impact.
How can I determine whether my deployment is affected?
The affected software identified is FastapiAdmin version 2.2.0. Review whether authenticated users or roles have the module_task:job:update permission and can access the /application/job/update/{id} endpoint.