CVE-2026-27953

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27953", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-25T03:11:36.691Z", "datePublished": "2026-03-19T20:23:06.379Z", "dateUpdated": "2026-03-20T18:10:57.521Z"}, "containers": {"cna": {"title": "ormar has a Pydantic Validation Bypass via Kwargs Injection in Model Constructor", "problemTypes": [{"descriptions": [{"cweId": "CWE-915", "lang": "en", "description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/ormar-orm/ormar/security/advisories/GHSA-f964-whrq-44h8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ormar-orm/ormar/security/advisories/GHSA-f964-whrq-44h8"}, {"name": "https://github.com/ormar-orm/ormar/commit/7f22aa21a7614b993970345b392dabb0ccde0ab3", "tags": ["x_refsource_MISC"], "url": "https://github.com/ormar-orm/ormar/commit/7f22aa21a7614b993970345b392dabb0ccde0ab3"}, {"name": "https://github.com/ormar-orm/ormar/blob/master/examples/fastapi_quick_start.py#L55", "tags": ["x_refsource_MISC"], "url": "https://github.com/ormar-orm/ormar/blob/master/examples/fastapi_quick_start.py#L55"}, {"name": "https://github.com/ormar-orm/ormar/blob/master/ormar/fields/foreign_key.py#L41", "tags": ["x_refsource_MISC"], "url": "https://github.com/ormar-orm/ormar/blob/master/ormar/fields/foreign_key.py#L41"}, {"name": "https://github.com/ormar-orm/ormar/blob/master/ormar/models/helpers/pydantic.py#L108", "tags": ["x_refsource_MISC"], "url": "https://github.com/ormar-orm/ormar/blob/master/ormar/models/helpers/pydantic.py#L108"}, {"name": "https://github.com/ormar-orm/ormar/blob/master/ormar/models/model.py#L89", "tags": ["x_refsource_MISC"], "url": "https://github.com/ormar-orm/ormar/blob/master/ormar/models/model.py#L89"}, {"name": "https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L128", "tags": ["x_refsource_MISC"], "url": "https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L128"}, {"name": "https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L292", "tags": ["x_refsource_MISC"], "url": "https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L292"}, {"name": "https://github.com/ormar-orm/ormar/releases/tag/0.23.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/ormar-orm/ormar/releases/tag/0.23.1"}], "affected": [{"vendor": "ormar-orm", "product": "ormar", "versions": [{"version": "< 0.23.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-19T20:23:06.379Z"}, "descriptions": [{"lang": "en", "value": "ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting \"__pk_only__\": true into a JSON request body. By injecting \"__pk_only__\": true into a JSON request body, an unauthenticated attacker can skip all field validation and persist unvalidated data directly to the database. A secondary __excluded__ parameter injection uses the same pattern to selectively nullify arbitrary model fields (e.g., email or role) during construction. This affects ormar's canonical FastAPI integration pattern recommended in its official documentation, enabling privilege escalation, data integrity violations, and business logic bypass in any application using ormar.Model directly as a request body parameter. This issue has been fixed in version 0.23.1."}], "source": {"advisory": "GHSA-f964-whrq-44h8", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/ormar-orm/ormar/security/advisories/GHSA-f964-whrq-44h8", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-20T17:04:35.323858Z", "id": "CVE-2026-27953", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-20T18:10:57.521Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27953", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-20T17:04:35.323858Z"}}}], "references": [{"url": "https://github.com/ormar-orm/ormar/security/advisories/GHSA-f964-whrq-44h8", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-20T17:04:45.691Z"}}], "cna": {"title": "ormar has a Pydantic Validation Bypass via Kwargs Injection in Model Constructor", "source": {"advisory": "GHSA-f964-whrq-44h8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "ormar-orm", "product": "ormar", "versions": [{"status": "affected", "version": "< 0.23.1"}]}], "references": [{"url": "https://github.com/ormar-orm/ormar/security/advisories/GHSA-f964-whrq-44h8", "name": "https://github.com/ormar-orm/ormar/security/advisories/GHSA-f964-whrq-44h8", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ormar-orm/ormar/commit/7f22aa21a7614b993970345b392dabb0ccde0ab3", "name": "https://github.com/ormar-orm/ormar/commit/7f22aa21a7614b993970345b392dabb0ccde0ab3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ormar-orm/ormar/blob/master/examples/fastapi_quick_start.py#L55", "name": "https://github.com/ormar-orm/ormar/blob/master/examples/fastapi_quick_start.py#L55", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ormar-orm/ormar/blob/master/ormar/fields/foreign_key.py#L41", "name": "https://github.com/ormar-orm/ormar/blob/master/ormar/fields/foreign_key.py#L41", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ormar-orm/ormar/blob/master/ormar/models/helpers/pydantic.py#L108", "name": "https://github.com/ormar-orm/ormar/blob/master/ormar/models/helpers/pydantic.py#L108", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ormar-orm/ormar/blob/master/ormar/models/model.py#L89", "name": "https://github.com/ormar-orm/ormar/blob/master/ormar/models/model.py#L89", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L128", "name": "https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L128", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L292", "name": "https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L292", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ormar-orm/ormar/releases/tag/0.23.1", "name": "https://github.com/ormar-orm/ormar/releases/tag/0.23.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting \"__pk_only__\": true into a JSON request body. By injecting \"__pk_only__\": true into a JSON request body, an unauthenticated attacker can skip all field validation and persist unvalidated data directly to the database. A secondary __excluded__ parameter injection uses the same pattern to selectively nullify arbitrary model fields (e.g., email or role) during construction. This affects ormar's canonical FastAPI integration pattern recommended in its official documentation, enabling privilege escalation, data integrity violations, and business logic bypass in any application using ormar.Model directly as a request body parameter. This issue has been fixed in version 0.23.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-915", "description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-19T20:23:06.379Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27953", "state": "PUBLISHED", "dateUpdated": "2026-03-20T18:10:57.521Z", "dateReserved": "2026-02-25T03:11:36.691Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-19T20:23:06.379Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "ormar", "vendor": "ormar-orm", "versions": [{"status": "affected", "version": "< 0.23.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:collerek:ormar:*:*:*:*:*:python:*:*", "matchCriteriaId": "28060AA9-6E58-42EE-9043-CC3998D6B0ED", "versionEndExcluding": "0.23.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting \"__pk_only__\": true into a JSON request body. By injecting \"__pk_only__\": true into a JSON request body, an unauthenticated attacker can skip all field validation and persist unvalidated data directly to the database. A secondary __excluded__ parameter injection uses the same pattern to selectively nullify arbitrary model fields (e.g., email or role) during construction. This affects ormar's canonical FastAPI integration pattern recommended in its official documentation, enabling privilege escalation, data integrity violations, and business logic bypass in any application using ormar.Model directly as a request body parameter. This issue has been fixed in version 0.23.1."}, {"lang": "es", "value": "ormar es un mini ORM as\u00edncrono para Python. Las versiones 0.23.0 e inferiores son vulnerables a un bypass de validaci\u00f3n de Pydantic a trav\u00e9s del constructor del modelo, permitiendo a cualquier usuario no autenticado omitir toda la validaci\u00f3n de campos inyectando '__pk_only__': true en un cuerpo de solicitud JSON. Al inyectar '__pk_only__': true en un cuerpo de solicitud JSON, un atacante no autenticado puede omitir toda la validaci\u00f3n de campos y persistir datos no validados directamente en la base de datos. Una inyecci\u00f3n de par\u00e1metro secundaria __excluded__ utiliza el mismo patr\u00f3n para anular selectivamente campos de modelo arbitrarios (p. ej., correo electr\u00f3nico o rol) durante la construcci\u00f3n. Esto afecta el patr\u00f3n can\u00f3nico de integraci\u00f3n de FastAPI de ormar recomendado en su documentaci\u00f3n oficial, permitiendo la escalada de privilegios, violaciones de integridad de datos y bypass de l\u00f3gica de negocio en cualquier aplicaci\u00f3n que utilice ormar.Model directamente como par\u00e1metro del cuerpo de la solicitud. Este problema ha sido solucionado en la versi\u00f3n 0.23.1."}], "id": "CVE-2026-27953", "lastModified": "2026-06-17T10:27:58.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27953", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-20T17:04:35.323858Z", "version": "2.0.3"}}]}, "published": "2026-03-19T21:17:09.573", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/ormar-orm/ormar/blob/master/examples/fastapi_quick_start.py#L55"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/ormar-orm/ormar/blob/master/ormar/fields/foreign_key.py#L41"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/ormar-orm/ormar/blob/master/ormar/models/helpers/pydantic.py#L108"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/ormar-orm/ormar/blob/master/ormar/models/model.py#L89"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L128"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L292"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/ormar-orm/ormar/commit/7f22aa21a7614b993970345b392dabb0ccde0ab3"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/ormar-orm/ormar/releases/tag/0.23.1"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/ormar-orm/ormar/security/advisories/GHSA-f964-whrq-44h8"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/ormar-orm/ormar/security/advisories/GHSA-f964-whrq-44h8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-915"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.23.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "ormar", "source": "cna", "vendor": "ormar-orm"}, "product": "ormar", "vendor": "ormar-orm"}], "analysis": {"en": {"generated_at": "2026-03-28T05:43:02.424307+00:00", "value": {"mitigation_remediation": ["Apply the latest ormar release (0.23.1 or later).", "If immediate upgrade is not possible, refrain from using ormar.Model for request body validation and instead perform explicit field validation in your application logic."], "summary": {"action": "Patch", "impact": "Data integrity compromise and privilege escalation"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the ormar ORM library, specifically versions 0.23.0 and earlier. Software that incorporates ormar for request parsing using the recommended FastAPI pattern is at risk. Any Python application that accepts request bodies mapped to ormar.Model instances, regardless of its overall architecture, is susceptible if it uses an affected version of ormar.", "description_and_impact": "An attacker can exploit a flaw in ormar, an asynchronous Python ORM, by inserting the special key \"__pk_only__\" with a value of true into a JSON request body. This bypasses all Pydantic validation performed by the model constructor, allowing the attacker to persist forged or malformed data directly into the database. A complementary \"__excluded__\" injection can selectively nullify arbitrary fields during construction, further enabling the attacker to null out sensitive fields such as email or role. The result is a violation of data integrity, the potential for privilege escalation, and a bypass of business logic for any application that employs ormar.Model directly as a request body parameter in its FastAPI integration.", "risk_and_exploitability": "The CVSS score is 7.1, indicating a high severity, while the EPSS score is below 1%, suggesting a low likelihood of widespread exploitation at present. The vulnerability is not listed in CISA's KEV catalog. The attack path is straightforward: an unauthenticated party can send a crafted JSON payload containing the special keys to an exposed API endpoint that deserializes the body into an ormar.Model instance. Because the model constructor is invoked automatically by FastAPI, no additional privileges are required. Once the bypass is achieved, the attacker can insert malicious data into the database, potentially altering or deleting crucial records and enabling further compromises."}}}}, "created": "2026-03-20T08:56:19.832755+00:00", "updated": "2026-03-29T20:28:56.864134+00:00", "vendors": ["ormar-orm", "ormar-orm$PRODUCT$ormar"]}