CVE-2026-7813

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions prior to 9.15

Description An authorization issue in server mode affects the Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules. Multiple endpoints fail to filter user-owned objects by the requesting user's identity, allowing an authenticated user to access another user's private servers, server groups, background processes, and debugger function arguments by guessing object IDs.

The Shared Servers feature also allows credential leakage of passfile, SSL keys, and passexec cmd. Furthermore, non-owners can write to owner-only fields via the API, including passexec cmd, passexec expiration, db res, and db res type. Modifying passexec cmd (a shell command executed during connection establishment) can lead to privilege escalation and arbitrary command execution within the owner's process context. Additionally, fields such as kerberos conn, tags, and post connection sql lack per-user persistence, meaning edits by non-owners mutate the owner's record, leading to data corruption via SQLAlchemy session mutations.

Recommendations Update pgAdmin 4 to version 9.15 or later.