In Starlette versions 1.0.1 and below, the HTTPEndpoint class dispatches requests by lowercasing the HTTP method and using getattr to find a handler method. However, if a route is registered without specifying the methods= argument, all HTTP methods are accepted, including non-standard ones. If a non-standard HTTP method matches an attribute name on the endpoint subclass, that attribute is invoked as a handler, potentially exposing internal methods not intended to be HTTP handlers. This unsafe reflection can lead to unauthorized access to internal functionality. The vulnerability is addressed in Starlette 1.1.0 by restricting method dispatching.

An attacker can invoke internal methods of an HTTPEndpoint subclass that were never intended to be exposed as HTTP handlers, bypassing authorization checks applied to intended public handlers. This can lead to unauthorized actions or information disclosure within applications using affected Starlette versions if routes are registered without method restrictions.

Upgrade Starlette to version 1.1.0 or later, where this issue is fixed. Until then, ensure that all Route registrations explicitly specify the methods= argument to restrict allowed HTTP methods and prevent invocation of unintended internal methods.