Executive brief
pgAdmin 4, a popular management tool for PostgreSQL databases, contains a critical authorization flaw when running in server mode. An authenticated user could access or modify other users' private server configurations, background processes, and debugger data by guessing object IDs. This could lead to the theft of database credentials, unauthorized access to sensitive data, or the execution of arbitrary commands on the server.
Technical details
pgAdmin 4 prior to version 9.15 fails to properly isolate user-owned objects in server mode. Multiple API endpoints fetched objects (Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules) without verifying that the requesting user owned the object, allowing access via ID guessing. Furthermore, the Shared Servers feature allowed non-owners to write to sensitive fields like 'passexec_cmd', which executes shell commands during connection establishment, leading to arbitrary command execution in the context of the owner's process. Other issues included credential leakage of SSL keys and passwords, and data corruption via SQLAlchemy session mutations. The fix introduces a centralized 'server_access' module and 'UserScopedMixin' to enforce strict ownership checks.
Affected products
- PostgreSQL pgAdmin 4 before 9.15
Timeline
- 2026-05-11: disclosed
- 2026-05-11: advisory
- 2026-04-13: patched: Remediation completed across two pull requests.