Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-116248— pgAdmin 4: Non-administrators can share a server with every user

Quick assessment

Affected
pgadmin.org pgAdmin 4
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 pgAdmin 4 的服务器模式下，仅管理员应能将服务器共享给所有用户；服务器对话框中的“共享”切换开关也仅对管理员可见。然而，服务器 API 的创建和更新端点却会存储客户端发送的"shared"（共享）标志及共享用户名，导致任何能够注册服务器的用户均可将其共享给所有其他用户。此外， 导入功能也存在类似漏洞：非管理员提交的“共享”条目仅在验证之后才会被移除，因此若导入文件中同时包含无效条目，仍可能成功创建共享服务器。 共享服务器本身不包含任何凭据，因此不会直接提供访问权限。但该漏洞允许攻击者在所有其他用户的服务

CVSS 6.8 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-116248

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
pgAdmin 4: Non-administrators can share a server with every user
Source: CVE Program / CVE List V5
Vulnerability Description
In pgAdmin 4 server mode only administrators are meant to share a server with all users; the server dialog shows the Shared switch only to them. The create and update endpoints of the server API, however, stored the "shared" flag and shared username they were sent, so any user able to register a server could share one with every other user. The servers.json import had a similar gap: a non-administrator's "Shared" entries were removed only after validation, so a file that also held an invalid entry could create a shared server. A shared server carries no credentials, so this gives no direct access. It lets a user plant a server, named to look trusted, in every other user's tree and pointing at a host the user controls; anyone who then connects to it presents their own database password to that host. The fix refuses a non-administrator's request that would share a server with HTTP 403, prunes a non-administrator's shared entries from a servers.json import before validating it, and warns at startup about servers shared earlier by non-administrators. This issue affects pgAdmin 4: before 9.19.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
pgadmin.org pgAdmin 4 0 ~ 9.19 -

II. Public POCs for CVE-2026-116248

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-116248

请登录查看更多情报信息。

Other References for CVE-2026-116248 (2)

Same Patch Batch · pgadmin.org · 2026-10-30 · 15 CVEs total

CVE-2026-116241 9.9 CRITICAL pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-
CVE-2026-116239 8.5 HIGH pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same usernam
CVE-2026-116249 8.4 HIGH pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory
CVE-2026-116247 8.2 HIGH pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certifica
CVE-2026-116245 8.2 HIGH pgAdmin 4: Connection services are not restricted in server mode
CVE-2026-116242 8.2 HIGH pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity
CVE-2026-116244 8.2 HIGH pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials
CVE-2026-116238 8.1 HIGH pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgA
CVE-2026-116243 7.5 HIGH pgAdmin 4: Utility binary path can point at a shared storage directory
CVE-2026-116252 6.5 MEDIUM pgAdmin 4: Materialized view refresh redirects its connection through a crafted database n
CVE-2026-116250 6.5 MEDIUM pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO p
CVE-2026-116246 6.5 MEDIUM pgAdmin 4: Server passwords are left in pgAdmin's process environment
CVE-2026-116240 6.5 MEDIUM pgAdmin 4: File Manager and storage-path tools act on a different path from the one checke
CVE-2026-116251 4.2 MEDIUM pgAdmin 4: A user's other sessions survive a change of their password

IV. Related Vulnerabilities

Same product: pgAdmin 4
Same vendor: pgadmin.org
Same weakness: CWE-862