CVE-2026-89267 debrief: starlette-admin 0.16.1 through 0.17.1 searchable fields allowlist bypass allows authenticated users to filter on non-searchable fields when configured as an empty list, enabling potential unauthorized data exposure and increasing the risk of targeted attacks using structured filter queries via the list API's where parameter. Defenders should prioritize verifying and remediating thi [truncated]
An authenticated user with access to an affected list endpoint in Starlette-Admin can submit arbitrary field names to bypass restrictions, causing limited information exposure and potential denial of service. This issue allows attackers to access sensitive information and potentially disrupt service, highlighting the need for prompt remediation and verification of input validation and access controls. Def [truncated]
