CVE-2026-111642 debrief: FastapiAdmin through 3.0 contains a hard-coded JWT signing secret, allowing low-privileged users to forge tokens impersonating the superuser. This vulnerability enables attackers to register via the unauthenticated /api/v1/system/user/register endpoint, log in, and forge an HS256 token with their session_id but naming the superuser in user_name to gain superuser privileges. Defend [truncated]
CVE-2026-111641 is a critical authentication bypass vulnerability in FastapiAdmin through version 3.0. The vulnerability allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control.
CVE-2026-36725 is a MEDIUM severity vulnerability with a CVSS score of 6.1. The vulnerability exists in FastapiAdmin v2.2.0 and allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the notice_content parameter of the /system/notice/create endpoint.
CVE-2026-36724 is a medium-severity vulnerability in FastapiAdmin v2.2.0. An uncaught exception in the /application/job/update/{id} endpoint allows authenticated attackers with the module_task:job:update permission to cause a Denial of Service (DoS) via manipulating the func field of scheduled tasks. The vulnerability has a CVSS score of 6.5 and is classified as CWE-400.
