Medium severity · published Feb 23, 2026
CVE-2026-2975
FastApiAdmin Custom Documentation Endpoint init_app.py reset_api_docs information disclosure
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
A security flaw has been discovered in FastApiAdmin up to 2.2.0. Affected by this vulnerability is the function reset_api_docs of the file /backend/app/plugin/init_app.py of the component Custom Documentation Endpoint. The manipulation results in information disclosure. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FA
FastApiAdmin ·
2.0; 2.1; 2.2.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-2975
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-2975
Exploit
https://github.com/CC-T-454455/Vulnerabilities/tree/master/fastapi-admin/vulnerability-1
Permissions Required
https://vuldb.com/?ctiid.347359
Third Party Advisory
https://vuldb.com/?id.347359
Third Party Advisory
https://vuldb.com/?submit.756067
More from FastApiAdmin
8.8
CVE-2026-2979
FastApiAdmin Scheduled Task API controller.py user_avatar_upload_controller unrestricted upload
8.8
CVE-2026-2978
FastApiAdmin Scheduled Task API controller.py upload_file_controller unrestricted upload
8.8
CVE-2026-2977
FastApiAdmin Scheduled Task API controller.py upload_controller unrestricted upload
6.5
CVE-2026-2976
FastApiAdmin Download Endpoint controller.py download_controller information disclosure