https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 01 Nov 2026 14:22:47 +0000 https://db.gcve.eu/vuln/cve-2026-116248 <p><strong>Affected:</strong> pgadmin.org pgAdmin 4</p> <p>In pgAdmin 4 server mode only administrators are meant to share a server with all users; the server dialog shows the Shared switch only to them. The create and update endpoints of the server API, however, stored the &#34;shared&#34; flag and shared username they were sent, so any user able to register a server could share one with every other user. The servers.json import had a similar gap: a non-administrator&#39;s &#34;Shared&#34; entries were removed only after validation, so a file that also held an invalid entry could create a shared server.</p> <p>A shared server carries no credentials, so this gives no direct access. It lets a user plant a server, named to look trusted, in every other user&#39;s tree and pointing at a host the user controls; anyone who then connects to it presents their own database password to that host.</p> <p>The fix refuses a non-administrator&#39;s request that would share a server with HTTP 403, prunes a non-administrator&#39;s shared entries from a servers.json import before validating it, and warns at startup about servers shared earlier by non-administrators.</p> <p>This issue affects pgAdmin 4: before 9.19.</p> <p><strong>Affected:</strong> pgadmin.org pgAdmin 4</p> <p>In pgAdmin 4 server mode only administrators are meant to share a server with all users; the server dialog shows the Shared switch only to them. The create and update endpoints of the server API, however, stored the &#34;shared&#34; flag and shared username they were sent, so any user able to register a server could share one with every other user. The servers.json import had a similar gap: a non-administrator&#39;s &#34;Shared&#34; entries were removed only after validation, so a file that also held an invalid entry could create a shared server.</p> <p>A shared server carries no credentials, so this gives no direct access. It lets a user plant a server, named to look trusted, in every other user&#39;s tree and pointing at a host the user controls; anyone who then connects to it presents their own database password to that host.</p> <p>The fix refuses a non-administrator&#39;s request that would share a server with HTTP 403, prunes a non-administrator&#39;s shared entries from a servers.json import before validating it, and warns at startup about servers shared earlier by non-administrators.</p> <p>This issue affects pgAdmin 4: before 9.19.</p> https://db.gcve.eu/vuln/cve-2026-116248