CVE-2026-54553: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in jowilf starlette-admin

Starlette-Admin before version 0.16.1 fails to validate user input for order_by and structured where clauses against configured allowlists for sortable and searchable fields. Authenticated users can submit arbitrary field names to the BaseModelView validation path, bypassing UI restrictions and potentially exposing sensitive information. Invalid or special Python attribute names can also trigger unhandled exceptions leading to HTTP 500 responses and limited denial of service. This vulnerability is identified as CWE-200 (Exposure of Sensitive Information), CWE-248 (Uncaught Exception), and CWE-639 (Authorization Bypass Through User-Controlled Key). No official remediation level or patch link is provided in the data, but the issue is fixed in version 0.16.1.

An authenticated user with access to affected list endpoints can bypass intended restrictions on sortable and searchable fields, leading to limited exposure of sensitive information. Additionally, malformed requests can cause unhandled exceptions resulting in HTTP 500 errors, causing limited denial of service for targeted requests. The CVSS score is 5.4 (medium severity), indicating a moderate impact on confidentiality and availability.

Upgrade to starlette-admin version 0.16.1 or later, where this vulnerability is fixed. Since no official patch link or advisory is provided, verify the upgrade from the vendor's official sources. No other mitigation actions are specified or required.