CVE-2026-2975 Details

A vulnerability allowing information disclosure exists in FastApiAdmin versions through 2.2.0. The issue arises in the 'reset_api_docs' function within '/backend/app/plugin/init_app.py', where custom API documentation endpoints are made available without authentication or authorization. This flaw enables unauthenticated attackers to access the OpenAPI specification and documentation pages, facilitating the enumeration of endpoints, parameters, models, and other metadata that could be exploited in targeted attacks or lead to the leakage of sensitive implementation details.

It is recommended to implement authentication and authorization for the documentation endpoints, restrict access to authorized users only, disable automatic API documentation generation in production environments, and use environment-based configuration to expose documentation only in development or staging environments.