An attacker can exploit a flaw in ormar, an asynchronous Python ORM, by inserting the special key "__pk_only__" with a value of true into a JSON request body. This bypasses all Pydantic validation performed by the model constructor, allowing the attacker to persist forged or malformed data directly into the database. A complementary "__excluded__" injection can selectively nullify arbitrary fields during construction, further enabling the attacker to null out sensitive fields such as email or role. The result is a violation of data integrity, the potential for privilege escalation, and a bypass of business logic for any application that employs ormar.Model directly as a request body parameter in its FastAPI integration.

The vulnerability affects the ormar ORM library, specifically versions 0.23.0 and earlier. Software that incorporates ormar for request parsing using the recommended FastAPI pattern is at risk. Any Python application that accepts request bodies mapped to ormar.Model instances, regardless of its overall architecture, is susceptible if it uses an affected version of ormar.

The CVSS score is 7.1, indicating a high severity, while the EPSS score is below 1%, suggesting a low likelihood of widespread exploitation at present. The vulnerability is not listed in CISA's KEV catalog. The attack path is straightforward: an unauthenticated party can send a crafted JSON payload containing the special keys to an exposed API endpoint that deserializes the body into an ormar.Model instance. Because the model constructor is invoked automatically by FastAPI, no additional privileges are required. Once the bypass is achieved, the attacker can insert malicious data into the database, potentially altering or deleting crucial records and enabling further compromises.