CVE-2026-89267

9th percentile - higher than 9% of all known CVEs

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality and comparison operations on excluded columns.

An authenticated user could filter and infer values from columns that should not be searchable, potentially leading to data leakage. The risk affects applications using starlette-admin with an empty searchable_fields list.

Upgrade starlette-admin to a version later than 0.17.1 or apply the vendor patch. Until patched, consider restricting list API access or defining a non-empty searchable_fields list.