CVE-2026-7813
Authorization Bypass in pgAdmin 4 Server Mode
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: PostgreSQL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pgadmin | pgadmin_4 | to 9.15 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-7813 is an authorization vulnerability in pgAdmin 4 server mode affecting multiple components including Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules.
The issue arises because multiple endpoints fetched user-owned objects without filtering by the requesting user's identity, allowing an authenticated user to access another user's private servers, server groups, background processes, and debugger function arguments simply by guessing object IDs.
The Shared Servers feature had additional problems such as credential leakage (including sensitive fields like passexec_cmd, passfile, SSL keys), privilege escalation through writable passexec_cmd allowing arbitrary command execution in the owner's process context, and owner-data corruption due to improper session mutations.
Several owner-only fields were writable by non-owners via the API, and some fields lacked per-user persistence, causing non-owner edits to mutate the owner's records.
The fix involved centralizing access control, scoping user-owned models with a UserScopedMixin, returning HTTP 410 when access is denied, suppressing owner-only fields for non-owners, and adding explicit owner-only write guards.
How can this vulnerability impact me? :
This vulnerability can have serious impacts including unauthorized access to private servers, server groups, background processes, and debugger data belonging to other users.
It can lead to credential leakage, exposing sensitive information such as shell commands, passwords, and SSL keys.
Privilege escalation is possible by exploiting writable fields like passexec_cmd, allowing an attacker to execute arbitrary commands in the context of the owner’s process.
Data corruption can occur due to non-owner users modifying owner-only fields, potentially disrupting server configurations and operations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves unauthorized access to other users' private servers, server groups, background processes, and debugger function arguments by guessing object IDs in pgAdmin 4 server mode. Detection would involve monitoring for unusual access patterns where authenticated users access resources not owned by them.
Since the vulnerability exploits API endpoints and object ID guessing, detection can include reviewing server logs for access attempts to server groups, servers, or debugger modules by users who do not own those objects.
Specific commands are not provided in the resources, but general approaches include:
- Checking pgAdmin 4 server logs for HTTP 200 responses to requests for server groups, servers, or debugger data by users other than the owner.
- Using network monitoring tools to detect unusual API calls or requests with guessed object IDs.
- Auditing database queries or API access logs for cross-user data access.
No explicit commands or scripts for detection are provided in the available resources.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability in pgAdmin 4 server mode, immediate steps include upgrading to version 9.15 or later where the fixes have been applied.
The fixes include centralized access control via a new server_access module, scoping all user-owned models with UserScopedMixin, enforcing strict ownership checks, and adding write guards to prevent non-owners from modifying sensitive fields.
Additional mitigation steps include:
- Apply the security patches from the referenced pull requests that address data isolation, privilege escalation, credential leakage, and data corruption.
- Restrict access to pgAdmin 4 server mode to trusted users only until the patch is applied.
- Review and audit user permissions and shared server configurations to minimize exposure.
- Monitor for suspicious activity related to shared server features and debugger modules.