CVE-2026-7813: pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode
Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules.
Multiple endpoints fetched user-owned objects without filtering by the requesting user's identity. An authenticated user could access another user's private servers, server groups, background processes, and debugger function arguments by guessing object IDs.
Additionally, the Shared Servers feature contained multiple issues including credential leakage (passexeccmd, passfile, SSL keys), privilege escalation via writable passexeccmd (a shell command executed when establishing the connection) allowing arbitrary command execution in the owner's process context, and owner-data corruption via SQLAlchemy session mutations. Several owner-only fields (passexeccmd, passexecexpiration, dbres, dbrestype) were writable by non-owners through the API, and additional fields (kerberosconn, tags, postconnectionsql) lacked per-user persistence so non-owner edits mutated the owner's record.
Fix centralises access control via a new serveraccess module, scopes all user-owned models with a UserScopedMixin, returns HTTP 410 from connectionmanager when access is denied in server mode, suppresses owner-only fields for non-owners across the merge / API response / ServerManager paths, and adds an explicit owner-only write guard. The remediation landed in two pull requests; both are referenced.
This issue affects pgAdmin 4: before 9.15.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pgAdmin 4to a version that resolves this vulnerability.Fixed in 9.15 - Configuration
Apply the remediation so centralized access control is enforced using the new server_access module and all user-owned models are scoped with UserScopedMixin to prevent cross-user object access (Server Groups, Servers, Shared Servers, Background Processes, Debugger).
pgAdmin 4 server mode server_access / UserScopedMixin = enabled (centralized access control with UserScopedMixin for user-owned models) - Configuration
Configure merge/API/ServerManager paths to suppress owner-only fields (passexec_cmd, passexec_expiration, db_res, db_res_type) for non-owners, and prevent non-owners from modifying owner-only fields via the API.
pgAdmin 4 server mode API/response owner-only fields visibility = suppressed for non-owners - Configuration
Add and enforce an explicit owner-only write guard so non-owners cannot update owner-only/writable fields and cannot mutate the owner's records (including passexec_cmd writable-by-non-owner privilege escalation and SQLAlchemy session mutation).
pgAdmin 4 server mode explicit owner-only write guard = enforced - Configuration
Apply per-user persistence so non-owner edits cannot mutate the owner record for additional fields including kerberos_conn, tags, and post_connection_sql (owner-scoped write/merge behavior).
pgAdmin 4 server mode per-user persistence for fields = owner-scoped persistence added - Compensating control
Ensure server mode access is denied by returning HTTP 410 from connection_manager when access is denied (as implemented via the new server_access module).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7813?
CVE-2026-7813 is classified as a high severity vulnerability due to its potential for cross-user data access and privilege escalation.
How does CVE-2026-7813 affect pgAdmin 4?
CVE-2026-7813 allows unauthorized access to user-owned objects by bypassing filtering mechanisms in various modules of pgAdmin 4.
How do I fix CVE-2026-7813?
To mitigate CVE-2026-7813, upgrade pgAdmin 4 to version 9.15 or later to ensure proper authorization and access controls.
What components of pgAdmin 4 are impacted by CVE-2026-7813?
CVE-2026-7813 affects Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules in pgAdmin 4.
Is there a workaround for CVE-2026-7813 until I can update?
There are no documented workarounds for CVE-2026-7813; the only recommended action is to apply the latest updates as soon as possible.