THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-6753-gr46-6wpr (medium) — Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

[GHSA] GHSA-6753-gr46-6wpr (medium) — Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

medgithub_advisoriesPublished 2026-08-26

GHSA-6753-gr46-6wpr Severity: medium CVE: CVE-2026-54553

Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

## Summary

Affected versions of Starlette-Admin prior to 0.16.1 do not properly validate user-supplied sort and search parameters against the configured field allowlists. While the administrative UI restricts availa

Indicators of compromise

CVE-2026-54553cve

Original source: https://github.com/advisories/GHSA-6753-gr46-6wpr