pgAdmin 4 CVE-2026-7814

Authentication as a pgAdmin administrator (PR:H in CVSS) is required - the attacker cannot be an unauthenticated remote user. The attacker must have CREATE privilege on at least one PostgreSQL database to inject the malicious object name. The victim (another pgAdmin user) must navigate to the Browser Tree or execute an EXPLAIN operation over the poisoned object - this is the UI:R (User Interaction Required) gate. The vulnerability does NOT affect default or standard pgAdmin configurations; it requires the presence of user-supplied PostgreSQL object names with HTML/JavaScript markup, which is non-standard. Scope is changed (S:C) because the XSS executes in another user's session, not just the attacker's own.

CVSS 4.8 with vector AV:N/AC:L/PR:H/UI:R/S:C indicates network accessibility but HIGH privilege requirement (PR:H = requires admin), low attack complexity, and required user interaction (UI:R). This significantly constrains real-world exploitation: an attacker must first be authenticated as a pgAdmin administrator (rare for external threat actors), then craft malicious PostgreSQL object names within databases they can modify, then socially engineer or coincidentally have another admin view the poisoned object. EPSS data not provided, but the combination of high CVSS-to-impact ratio (4.8 is artificially low due to PR:H requirement) suggests this is lower priority than unauthenticated network XSS. The stored nature and cross-user impact (C:L/I:L for other users' browsers) elevate it above typical self-XSS, but the authentication barrier makes this an insider-threat or supply-chain risk rather than a critical external vulnerability. No evidence of public exploit or active exploitation provided. Confidence: moderate - CVSS vector is clear but real-world exploitability is heavily gated by admin auth.

An authenticated pgAdmin administrator (Attacker A) with write access to a PostgreSQL database creates a table with a name such as 'test<img src=x onerror=alert(1)>' or a schema containing JavaScript. When a second pgAdmin user (Victim) navigates to the Browser Tree or runs an EXPLAIN query over the malicious object, the crafted JavaScript executes in Victim's browser within pgAdmin's security context, potentially stealing session cookies or performing unauthorized database actions on behalf of Victim. No public exploit code has been identified.