CVE-2026-89267: starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass
starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchablefields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality and comparison operations on excluded columns.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to the bypass?
The issue applies to Starlette-Admin 0.16.1 through 0.17.1 when searchable_fields is configured as an empty list. The described bypass is tied specifically to that empty-list configuration.
What access does an attacker need?
An attacker must be authenticated and able to submit requests to the list API. They can use the where parameter to send structured filter queries.
What can an attacker do with the bypass?
They can filter on columns that were intended to be excluded from searching, using equality and comparison operations. The reported impact is limited to confidentiality; no integrity or availability impact is specified.
How can I check whether my deployment is affected?
Check whether your Starlette-Admin version is between 0.16.1 and 0.17.1 and inspect the affected view configuration for searchable_fields set to an empty list. Also verify whether authenticated users can reach the relevant list API endpoint and supply a where parameter.