CVE-2026-7813
Severity CVSS v4.0:
CRITICAL
Type:
CWE-284
Improper Access Control
Publication date:
11/05/2026
Last modified:
13/05/2026
Description
Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules.<br />
<br />
Multiple endpoints fetched user-owned objects without filtering by the requesting user&#39;s identity. An authenticated user could access another user&#39;s private servers, server groups, background processes, and debugger function arguments by guessing object IDs.<br />
<br />
Additionally, the Shared Servers feature contained multiple issues including credential leakage (passexec_cmd, passfile, SSL keys), privilege escalation via writable passexec_cmd (a shell command executed when establishing the connection) allowing arbitrary command execution in the owner&#39;s process context, and owner-data corruption via SQLAlchemy session mutations. Several owner-only fields (passexec_cmd, passexec_expiration, db_res, db_res_type) were writable by non-owners through the API, and additional fields (kerberos_conn, tags, post_connection_sql) lacked per-user persistence so non-owner edits mutated the owner&#39;s record.<br />
<br />
Fix centralises access control via a new server_access module, scopes all user-owned models with a UserScopedMixin, returns HTTP 410 from connection_manager when access is denied in server mode, suppresses owner-only fields for non-owners across the merge / API response / ServerManager paths, and adds an explicit owner-only write guard. The remediation landed in two pull requests; both are referenced.<br />
<br />
This issue affects pgAdmin 4: before 9.15.
Impact
Base Score 4.0
9.40
Severity 4.0
CRITICAL
Base Score 3.x
9.90
Severity 3.x
CRITICAL