CVE-2026-17348

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 1.0 through 9.16

Description When operating in SERVER mode, the application fails to enforce authentication on several routes because they lack the @pga login required decorator. This allows an unauthenticated network client to perform unauthorized actions, including enumerating constraint metadata, deleting table constraints, reading CLI-settable preference values, and force-closing debugger or schema-diff sessions belonging to other users. The affected routes include the Constraints blueprint's nodes, proplist, and delete routes, as well as the preferences.get all cli (GET), debugger.close (DELETE), and schema diff.close (DELETE) endpoints.

Recommendations Update pgAdmin 4 to version 9.17 or later.