CVE-2026-91924

Name of the Vulnerable Software and Affected Versions pgweb versions prior to 0.17.1

Description The application fails to implement authorization checks on the 'POST /api/connect' endpoint when connect-backend authorization is configured. This allows an attacker to bypass the resource-to-database mapping by providing a custom session identifier and a connection URL. Consequently, an attacker can supply arbitrary database connection strings to gain unauthorized access to other databases and internal services reachable from the host.

Recommendations Update pgweb to a version later than 0.17.0. Restrict access to the 'POST /api/connect' endpoint to minimize the risk of exploitation.