CVE-2026-27953
Published: 19 March 2026
Description
ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting "__pk_only__": true into a JSON request body.…
more
By injecting "__pk_only__": true into a JSON request body, an unauthenticated attacker can skip all field validation and persist unvalidated data directly to the database. A secondary __excluded__ parameter injection uses the same pattern to selectively nullify arbitrary model fields (e.g., email or role) during construction. This affects ormar's canonical FastAPI integration pattern recommended in its official documentation, enabling privilege escalation, data integrity violations, and business logic bypass in any application using ormar.Model directly as a request body parameter. This issue has been fixed in version 0.23.1.
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces input validation at entry points to prevent bypass of Pydantic field validations in ormar model constructors via malicious JSON parameters like '__pk_only__'.
Requires timely remediation by patching ormar to version 0.23.1, eliminating the validation bypass vulnerability in the model constructor.
Enforces restrictions on input fields at API boundaries, blocking injection of unauthorized parameters such as '__pk_only__' and '__excluded__' in JSON request bodies.
Security SummaryAI
CVE-2026-27953 is a Pydantic validation bypass vulnerability in ormar, an async mini ORM for Python. Versions 0.23.0 and below are affected, where attackers can inject "__pk_only__": true into a JSON request body via the model constructor to skip all field validation and persist unvalidated data directly to the database. A secondary injection using the "__excluded__" parameter allows selective nullification of arbitrary model fields, such as email or role, during construction. This issue impacts ormar's canonical FastAPI integration pattern, as recommended in its official documentation, when using ormar.Model directly as a request body parameter.
An unauthenticated attacker can exploit this vulnerability over the network with low privileges by crafting a JSON request body containing the malicious parameters. Successful exploitation enables privilege escalation, data integrity violations, and business logic bypass in affected applications, as unvalidated or manipulated data is persisted to the database. The CVSS v3.1 base score is 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L), highlighting high integrity and low availability impact, mapped to CWE-20 (Improper Input Validation) and CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes).
The vulnerability has been fixed in ormar version 0.23.1. References point to specific code locations in the ormar GitHub repository, including the FastAPI quick start example and model construction logic in files like foreign_key.py, pydantic.py, model.py, and newbasemodel.py, confirming the root cause in the model's Pydantic integration. Security practitioners should upgrade to the patched version and review applications using ormar with FastAPI for exposure.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a public-facing FastAPI application flaw exploitable over the network (T1190). It directly enables privilege escalation by bypassing validation to persist manipulated data like roles (T1068).