Starlette-Admin allows an authenticated user with access to a list endpoint to supply arbitrary field names to the order_by and where parameters. Because these parameters are not validated against the configured sortable_fields and searchable_fields allowlists, an attacker can sort or filter by hidden columns, revealing data that should not be exposed. Additionally, specifying non‑existent or special Python attribute names such as __metadata__ can trigger unhandled exceptions, resulting in HTTP 500 responses that cause a limited denial of service for targeted requests. This vulnerability yields information disclosure and a small outage risk, but does not provide remote code execution or broad system control.

The affected product is Starlette‑Admin, version 0.16.0 and earlier, maintained by the vendor jowilf. Any deployment that exposes the administrative list endpoint to authenticated users is vulnerable until the software is updated to version 0.16.1 or later.

The vulnerability carries a CVSS score of 5.4, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because exploitation requires an authenticated user who has permission to access the list endpoint, the attack vector is likely internal or granted after the user has already logged into the application. Attackers can exploit the allowance of hidden columns to gather sensitive data and can trigger 500 errors to disrupt service. The limited denial of service is scoped to the specific endpoint and does not affect the overall application availability.