Pgweb
Monthly
We need to produce JSON. Let me analyze. CVE-2026-91924: pgweb through 0.17.0, missing authorization on POST /api/connect. CWE-862 (Missing Authorization). CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N → base score roughly 8.4? Let's check: CVSS 4.0 with PR:L, VC:H, VI:L, SC:H, SI:L → probably ~8.4 is plausible? Actually with PR:L and no VA/SA... Let's just take given 8.4. PR:L means authenticated (or requires some privileges). So "authenticated" is allowed since vector contains PR:L. No KEV, no POC mentioned. So "no public exploit identified at time of analysis". Hmm, but there's a GitHub issue #869 — that's a report but not necessarily public exploit code. Patch status: no fix version given; references include a GitHub issue and code at a specific commit 6b0b0244... That commit hash could be before or after fix. Hmm. The references point to routes.go and api.go at commit 6b0b0244d1aefd6971999b03481eeeaa4ec7cf55 — presumably the vulnerable code. No fix version provided. So "No vendor-released patch identified at time of analysis" — but careful, absence of data is not confirmation. Actually pgweb is at 0.17.0 "through" which suggests the latest version is vulnerable. Rule says use most specific that applies; if patch data says NOT available → "No vendor-released patch identified at time of analysis". We don't have patch data explicitly. I'll say no vendor-released patch identified in the provided intel; issue #869 referenced. Product name: "pgweb" — 1-3 words. Just "pgweb". Summary: must not start with "A vulnerability". Start with specific impact verb and product. E.g. "Missing authorization in pgweb through 0.17.0 lets anyone able to reach the web UI's connect endpoint..." Note PR:L — requires low privileges, i.e., a session/authenticated user of pgweb UI. Write original synthesis. Technical context: pgweb is a Go-based, cross-platform PostgreSQL web client/browser (sosedoff/pgweb). Connect-backend authorization (--connect-backend?
We need to produce JSON. Let me analyze. CVE-2026-91924: pgweb through 0.17.0, missing authorization on POST /api/connect. CWE-862 (Missing Authorization). CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N → base score roughly 8.4? Let's check: CVSS 4.0 with PR:L, VC:H, VI:L, SC:H, SI:L → probably ~8.4 is plausible? Actually with PR:L and no VA/SA... Let's just take given 8.4. PR:L means authenticated (or requires some privileges). So "authenticated" is allowed since vector contains PR:L. No KEV, no POC mentioned. So "no public exploit identified at time of analysis". Hmm, but there's a GitHub issue #869 — that's a report but not necessarily public exploit code. Patch status: no fix version given; references include a GitHub issue and code at a specific commit 6b0b0244... That commit hash could be before or after fix. Hmm. The references point to routes.go and api.go at commit 6b0b0244d1aefd6971999b03481eeeaa4ec7cf55 — presumably the vulnerable code. No fix version provided. So "No vendor-released patch identified at time of analysis" — but careful, absence of data is not confirmation. Actually pgweb is at 0.17.0 "through" which suggests the latest version is vulnerable. Rule says use most specific that applies; if patch data says NOT available → "No vendor-released patch identified at time of analysis". We don't have patch data explicitly. I'll say no vendor-released patch identified in the provided intel; issue #869 referenced. Product name: "pgweb" — 1-3 words. Just "pgweb". Summary: must not start with "A vulnerability". Start with specific impact verb and product. E.g. "Missing authorization in pgweb through 0.17.0 lets anyone able to reach the web UI's connect endpoint..." Note PR:L — requires low privileges, i.e., a session/authenticated user of pgweb UI. Write original synthesis. Technical context: pgweb is a Go-based, cross-platform PostgreSQL web client/browser (sosedoff/pgweb). Connect-backend authorization (--connect-backend?