Executive brief
pgweb is a cross-platform web client for PostgreSQL databases. When configured with connect-backend authorization, the /api/connect endpoint fails to properly validate requests, allowing attackers to bypass access controls and connect to unauthorized databases or internal services by supplying arbitrary connection strings and session identifiers.
Technical details
This is an authentication bypass vulnerability in pgweb's API endpoint. The POST /api/connect endpoint does not properly enforce authorization checks when the connect-backend authorization mode is enabled, allowing an attacker to supply arbitrary database connection strings and custom session identifiers. The vulnerability permits circumvention of the resource-to-database mapping that should restrict which databases a user can access. Attack vector is network-based with no authentication required to exploit the flaw. An attacker can leverage this to access unauthorized PostgreSQL databases and potentially reach internal services, exposing sensitive data or enabling further compromise.
Affected products
- sosedoff pgweb through 0.17.0
Timeline
- 2026-09-15: disclosed