CVE-2026-36724 Details

A denial-of-service vulnerability has been identified in FastapiAdmin versions through 2.2.0. The issue arises in the '/api/v1/application/job/update/{id}' endpoint, where the 'func' field of scheduled tasks is not properly validated before being saved to the database. This lack of validation allows authenticated attackers with the 'module_task:job:update' permission to manipulate the 'func' field, causing an uncaught exception when the application attempts to reload scheduled tasks. The exception disrupts the application initialization process, preventing the web server from starting and causing a denial-of-service condition.

To address this vulnerability, implement input validation on the 'func' field to ensure it contains valid module paths. Additionally, enhance the exception handling in the task initialization process to catch and manage potential errors from the 'rsplit' operation. Finally, validate task configurations before saving them to the database.