CVE-2026-27953 Details
Description
ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting "__pk_only__": true into a JSON request body. By injecting "__pk_only__": true into a JSON request body, an unauthenticated attacker can skip all field validation and persist unvalidated data directly to the database. A secondary __excluded__ parameter injection uses the same pattern to selectively nullify arbitrary model fields (e.g., email or role) during construction. This affects ormar's canonical FastAPI integration pattern recommended in its official documentation, enabling privilege escalation, data integrity violations, and business logic bypass in any application using ormar.Model directly as a request body parameter. This issue has been fixed in version 0.23.1.
A vulnerability in the Ormar library for Python allows for Pydantic validation to be bypassed in versions through 0.23.0. This issue arises from the model constructor's acceptance of injected parameters that can skip crucial validation checks. Unauthenticated users can exploit this by sending JSON requests that include the '__pk_only__' parameter, which bypasses all field validation and allows unvalidated data to be saved directly to the database. Additionally, the '__excluded__' parameter can be used to nullify specific fields during the model's construction. This vulnerability impacts applications that use Ormar's models with FastAPI, following the integration pattern recommended in the official documentation.
Users are advised to upgrade to Ormar version 0.23.1, where this vulnerability has been fixed. In the updated version, the library no longer allows the injection of '__pk_only__' and '__excluded__' parameters through user-supplied kwargs, preventing the validation bypass and field nullification that could be exploited in previous versions.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| collerek ormar | < 0.23.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 27, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | CVE Modified | CISA-ADP |
| Mar 19, 2026 | New CVE Received | [email protected] |