Junglewise Threat Intelligence

CVE-2026-17350: PostgreSQL pgAdmin 4 missing authorization in per-tool permissions

CVE-2026-17350 · Severity: medium · CVSS 5.4 · Published 2026-07-31

Executive brief

pgAdmin 4, a popular management tool for PostgreSQL databases, contains a flaw in how it restricts access to specific features like the Query Tool, Backup, and PSQL console. An authenticated user who has been intentionally restricted from using certain tools by an administrator can bypass these restrictions and use them anyway. This allows users to perform actions or view data using features they were supposed to be blocked from, though they are still limited by their underlying database permissions.

Technical details

A missing authorization vulnerability exists in pgAdmin 4's per-tool permission system introduced in version 9.3. While the 'permissions_required' decorator was applied to the initial entry point of various tools (Query Tool, Grant Wizard, Schema Diff, ERD, PSQL, Debugger, etc.), subsequent backend routes and Socket.IO event handlers only checked for general authentication ('pga_login_required' or 'socket_login_required'). An authenticated attacker with a valid database connection can bypass tool-level restrictions to execute queries, generate DDL, or initiate backup/restore jobs. The fix introduces a new 'socket_permissions_required' decorator and ensures all relevant routes and socket handlers enforce the specific tool permissions.

Affected products

  • PostgreSQL pgAdmin 4 9.3 to 9.16

Timeline

  • 2026-07-31: advisory: CVE-2026-17350 published
  • 2026-07-31: disclosed

References

Related threats