CVE-2026-36724
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
An uncaught exception in the /application/job/update/{id} endpoint of FastapiAdmin v2.2.0 allows authenticated attackers with the module_task:job:update permission to cause a Denial of Service (DoS) by manipulating the func field of scheduled tasks.
Risk Assessment
An attacker can cause FastapiAdmin to become unavailable, preventing its use.
Recommendation
Update FastapiAdmin to a patched version or restrict permissions to modify tasks.
Other vulnerabilities in FastapiAdmin
See all- CVE-2026-111642High
FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoint, log in, and forge an HS256 token keeping their session_id but naming the superuser in user_name to gain superuser privileges.
- CVE-2026-111641Critical
FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control.
- CVE-2026-36728Medium
The AI assistant chat function in FastapiAdmin v2.2.0 has a Markdown-based XSS vulnerability. Attackers can inject arbitrary scripts or HTML by sending a crafted chat message.
- CVE-2026-36725Medium
FastapiAdmin version v2.2.0 contains a Markdown-based XSS vulnerability in the /system/notice/create endpoint. Attackers can inject malicious JavaScript or HTML into the notice_content parameter, which will be executed in the victim's browser.
Original NVD description (English source)
An uncaught exception in the /application/job/update/{id} endpoint of FastapiAdmin v2.2.0 allows authenticated attackers with the module_task:job:update permission to cause a Denial of Service (DoS) via manipulating the func field of scheduled tasks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS