Overview
CVE-2026-2975 describes a security flaw in FastApiAdmin up to version 2.2.0 where the function reset_api_docs in the Custom Documentation Endpoint improperly handles access control, leading to information disclosure. This vulnerability is an instance of Broken Object Level Authorization: an endpoint that manipulates or reveals sensitive application data (in this case, the OpenAPI/OpenAPI-like documentation) can be accessed without proper authorization. An attacker who can reach the remote server could trigger the reset_api_docs path and retrieve the entire API surface, including internal routes, schemas, and security details, increasing the attack surface for further abuse. The CVE highlights how a trusted admin-like operation can expose objects (the API docs) to unauthorized actors, effectively leaking sensitive information about the backend and its endpoints. The disclosure is mediated by a public exploit release, amplifying the risk in production environments where docs or admin endpoints were left unprotected. CWE-200 (Information Exposure) and CWE-284 (Improper Access Control) map to this class of vulnerability, where an object (the API documentation) is accessible without verifying the requester’s authorization, enabling information leakage and potential misuse.
Affected Versions
FastApiAdmin up to 2.2.0 (<= 2.2.0)
Code Fix Example
FastAPI API Security Remediation
# Vulnerable pattern (no auth on admin docs)
from fastapi import FastAPI
vuln_app = FastAPI()
@vuln_app.post("/admin/reset_api_docs")
async def reset_api_docs_vuln():
# Exposes the full OpenAPI schema to any caller
return vuln_app.openapi()
# Fixed pattern (requires admin authentication)
from fastapi import FastAPI, Depends, HTTPException
from fastapi.security import OAuth2PasswordBearer
secure_app = FastAPI()
oauth2_scheme = OAuth2PasswordBearer(tokenUrl="/token")
async def get_current_admin(token: str = Depends(oauth2_scheme)):
# Implement real token validation and admin check in production
if token != "admin-token":
raise HTTPException(status_code=401, detail="Unauthorized")
return {"username": "admin", "is_admin": True}
@secure_app.post("/admin/reset_api_docs")
async def reset_api_docs_secure(user = Depends(get_current_admin)):
# Admins can access or trigger a docs reset; otherwise, access is denied
return secure_app.openapi()