CVE-2026-27953: ormar Pydantic Validation Bypass via Kwargs Injection in Model Constructor
The ormar asynchronous mini ORM for Python allows an unauthenticated user to skip Pydantic field validation through its model constructor when a model is used directly as a JSON request body parameter, according to the record. The description says versions up to and including 0.23.0 are affected and that the issue is fixed in 0.23.1. NVD rates it critical (CVSS 3.1 9.8), and no confirmed exploitation appears in the sources consulted.
Overview
The ormar project, an asynchronous mini ORM for Python, has a validation bypass in its model constructor. According to the record, versions up to and including 0.23.0 let an unauthenticated user skip field validation when a model is built from a JSON request body, and the fix is in 0.23.1.
Impact
- Unvalidated data can be persisted directly to the database.
- Certain model fields, such as those tied to roles or contact data, can be nullified during construction through a secondary parameter, according to the description.
- The description links the issue to privilege escalation, data integrity violations and business logic bypass in applications that pass ormar models directly as request body parameters.
- NVD scores the issue 9.8 (critical) under CVSS 3.1. GitHub Security Advisories records 7.1 under CVSS 3.1.
Affected products and versions
- Collerek Ormar: before 0.23.1, as listed in the record.
- Ormar-orm Ormar: before 0.23.1, as listed in the record.
- The description identifies 0.23.0 and earlier as vulnerable and 0.23.1 as the fixed release.
Exploitation status
The CVE is not listed in the CISA KEV catalog. The sources consulted do not confirm active exploitation in the wild. The record's SSVC data shows exploitation value poc and automatable no. One advisory reference carries an Exploit tag, but that tag alone does not confirm attacks.
Remediation and mitigation
- Upgrade ormar to 0.23.1 or later, as described in the GitHub Security Advisory and the release notes.
- Until the upgrade is applied, avoid passing ormar model classes directly as request body parameters. Use separate input schemas that accept only the fields intended for clients. This is an inference from the description, not a workaround stated by the vendor.
- Review database records written through affected endpoints for unexpected null or unvalidated values.
Detection guidance
- Review web application logs for JSON request bodies containing unexpected internal-style keys.
- Audit endpoints that accept ORM model objects as request bodies, and check whether validation errors are missing where they would normally appear.
- Monitor for unexpected changes to sensitive fields such as roles or contact data.
Limitations of the available information
- The record gives no proof-of-concept details or exploit conditions beyond the summary, and none are provided here.
- The record does not explain the difference between the NVD score (9.8) and the GitHub score (7.1).
- The record does not state which application configurations are most exposed beyond the FastAPI pattern described in the advisory.
Frequently asked questions
What is the core problem in CVE-2026-27953?
According to the record, the ormar model constructor can be made to skip Pydantic field validation when a model is used directly as a JSON request body parameter, which can let unvalidated data reach the database.
Which versions are fixed?
The description states that versions up to and including 0.23.0 are vulnerable and that the issue is fixed in 0.23.1. Upgrade to 0.23.1 or later.
Is this vulnerability known to be exploited in the wild?
The CVE is not listed in CISA KEV, and the sources consulted do not confirm active exploitation. The record's SSVC data indicates a proof-of-concept exploitation value, which does not by itself confirm attacks.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.