Pgweb
Monthly
Missing authorization on pgweb's POST /api/connect endpoint through version 0.17.0 lets attackers bypass the connect-backend resource-to-database mapping by submitting a custom session identifier and arbitrary connection URL, granting access to databases and internal services the operator never intended to expose. The flaw is CWE-862 (missing authorization) and carries a CVSS 4.0 base score of 8.4 (AV:N/AC:L/PR:L/UI:N, high confidentiality impact on both the vulnerable system and subsequent systems), reflecting that a successful attacker can read arbitrary backend data while the pgweb host is used as a pivot. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation is currently assessed as opportunistic rather than confirmed active.
Missing authorization on pgweb's POST /api/connect endpoint through version 0.17.0 lets attackers bypass the connect-backend resource-to-database mapping by submitting a custom session identifier and arbitrary connection URL, granting access to databases and internal services the operator never intended to expose. The flaw is CWE-862 (missing authorization) and carries a CVSS 4.0 base score of 8.4 (AV:N/AC:L/PR:L/UI:N, high confidentiality impact on both the vulnerable system and subsequent systems), reflecting that a successful attacker can read arbitrary backend data while the pgweb host is used as a pivot. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation is currently assessed as opportunistic rather than confirmed active.