EUVD-2026-114389
GHSA-jjwq-6v5r-fhwh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege pgAdmin user
-
DeliverySubmit server API payload (or servers.json) with 'shared' flag set
-
ExploitTrusted-looking shared server planted in all users' trees
-
ExecutionVictim connects and submits own DB password
-
ImpactAttacker-controlled host captures victim's database credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable only when pgAdmin runs in multi-user SERVER_MODE (desktop mode is unaffected). The attacker must already hold an authenticated account with at least the stock 'User' role that permits registering a server (PR:L); unauthenticated exploitation is not possible. Planting the server requires no victim action, but the damaging credential-capture outcome depends on a separate victim actively connecting to the planted server and entering their own database password (UI:A), and on the planted server pointing at a host the attacker controls. These interaction and authentication requirements, plus the server-mode-only exposure, materially limit real-world impact below the raw vector. |
| Impact | This is a moderate, authorization-focused issue (CWE-862, missing authorization) rather than a high-urgency emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A, score 6.0) tells the real story: network-reachable and low-complexity, but it requires an authenticated low-privilege account (PR:L) AND active victim interaction (UI:A) to reach meaningful impact. The vulnerable-system impact is only VI:L (an attacker can plant a shared server record in other users' trees), with VC:N/VA:N - no direct data access. The elevated SC:H reflects the real danger: a victim who connects to the planted, attacker-controlled host hands over their own database password, so the serious outcome lands on a subsequent system (the victim's PostgreSQL credentials/DB), not pgAdmin itself. No EPSS score, no CISA KEV listing, and no public exploit reference are present in the input, and the vuln.today decision label is 'this_month' (not act_now/emergency) - all consistent with a patch-this-cycle priority rather than a drop-everything incident. There is no signal conflict to flag: every source points to a credible but conditional, interaction- and authentication-gated phishing-style credential-capture risk. |
| Exploit ScenarioDerived | An authenticated pgAdmin user with only the stock 'User' role (enough to register a server) sends a create/update request to the server API - or imports a crafted servers.json - carrying the 'shared' flag, which the backend previously stored without checking the caller's role. A server named to look official (e.g. 'Production DB') then appears in every other user's browser tree pointing at a host the attacker controls; when a trusting colleague clicks it and enters their database password, that password is transmitted to the attacker's host. No public exploit code is identified in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
pgAdmin 4 before 9.19 fails to enforce the administrator-only restriction on server sharing in server mode: the server API create and update endpoints persist a 'shared' flag and shared username supplied by any authenticated user holding the stock 'User' role, and the servers.json import prunes a non-administrator's shared entries only after validation, so a file containing an invalid entry can still smuggle in a shared server. The planted server carries no stored credentials, so the direct impact is limited to its insertion into every other user's tree, named to look trustworthy and pointed at an attacker-controlled host; the damaging outcome requires a separate victim to connect and hand over their own database password. Fixes are released in 9.19 and no public exploit has been identified at time of analysis, though the exposure is confined to multi-user deployments running SERVER_MODE rather than desktop mode.
RemediationAI
Upgrade to pgAdmin 4 9.19 or later, which is the vendor-released fix; the commit d761942d0bb84d52b18e81307064dd08e26224e3 adds the HTTP 403 refusal for non-administrator sharing on the create and update endpoints, reorders the servers.json import so non-administrator shared entries are pruned before validation, and emits a startup warning for servers shared earlier by non-administrators. The patch does not retroactively un-share existing records, so administrators must audit the configuration database for server rows with the shared flag set whose owner lacks the Administrator role - the startup log enumerates exactly these. Each flagged server can be un-shared by its owner via a PUT request to the server API with "shared": false, or by an administrator directly updating the shared column of the server record; note that un-sharing removes the server from other users' trees and will interrupt anyone relying on the planted entry, which is the intended outcome. Where upgrading is not immediately possible, restricting account creation and the ability to register servers to vetted users reduces the attacker population that can reach either endpoint, and reviewing imported servers.json content before ingest limits the import vector, at the cost of ongoing manual review rather than enforcement.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a missing-authorization case (CWE-862). pgAdmin's server dialog only renders the 'Shared' switch for the Administrator role, but the underlying REST handlers in web/pgadmin/browser/server_groups/servers/__init__.py accepted and stored the 'shared' flag and 'shared_username' value from any caller allowed to register a server, so the UI-level restriction was never backed by a server-side check. The servers.json import path had a parallel gap in validate_json_data and load_database_servers: a non-administrator's Shared entries were stripped only after validation, meaning a file combining a shared server with a deliberately invalid entry could fail validation early and still leave the shared record created. Because a shared server definition holds connection parameters but no credentials, the mechanism is a naming and trust-abuse play rather than direct credential disclosure, and the upstream fix adds a prepare_sharing_data helper that returns HTTP 403 for non-administrators on create/update, moves the import pruning ahead of validation, strips shared_username from non-admin payloads, stops non-admin server copies from inheriting the shared flag, and logs a startup warning listing servers shared earlier by non-administrators.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N
Authenticated low-priv registrant (PR:L) plants a shared record (I:L); victim must connect (UI:R); scope changes (S:C) to the victim's database where the captured password yields C:H.
Primary rating from Vendor (f86ef6dc-4d3a-42ad-8f28-e6d5547a5007).
CVSS VectorVendor: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
Lifecycle Timeline
1DescriptionCVE.org
In pgAdmin 4 server mode only administrators are meant to share a server with all users; the server dialog shows the Shared switch only to them. The create and update endpoints of the server API, however, stored the "shared" flag and shared username they were sent, so any user able to register a server could share one with every other user. The servers.json import had a similar gap: a non-administrator's "Shared" entries were removed only after validation, so a file that also held an invalid entry could create a shared server.
A shared server carries no credentials, so this gives no direct access. It lets a user plant a server, named to look trusted, in every other user's tree and pointing at a host the user controls; anyone who then connects to it presents their own database password to that host.
The fix refuses a non-administrator's request that would share a server with HTTP 403, prunes a non-administrator's shared entries from a servers.json import before validating it, and warns at startup about servers shared earlier by non-administrators.
This issue affects pgAdmin 4: before 9.19.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB