An uncaught exception within the /application/job/update/{id} endpoint of FastapiAdmin 2.2.0 allows an authenticated attacker who holds the module_task:job:update permission to trigger a denial of service by manipulating the func field that specifies how scheduled tasks are executed. The vulnerability arises because the application fails to handle errors in this endpoint, causing the service to become unresponsive or crash. The impact is a loss of availability for the affected FastapiAdmin instance, potentially affecting all users and downstream services that rely on it.

FastapiAdmin version 2.2.0 is affected. Applications that expose the /application/job/update/{id} endpoint and grant module_task:job:update authority to users are at risk. No other product versions were listed as vulnerable.

The CVSS score of 6.5 indicates moderate severity. The attacker needs valid credentials and the module_task:job:update permission to invoke the endpoint, making the attack vector likely internal or authenticated external. The EPSS score is unavailable, and the issue is not listed in the CISA KEV catalog. Once exploited, the service may become unreachable, so the risk is significant for environments that depend on continuous availability.