Authentication Bypass in pgAdmin 4 Affecting Multiple Routes

CVE-2026-17348

What is CVE-2026-17348?

In SERVER mode, pgAdmin 4 displays a security vulnerability due to the improper enforcement of authentication across certain routes. Specifically, the implementation mishandles the authentication for routes not protected by the @pga_login_required decorator. This allows unauthorized access to sensitive functionalities such as enumerating constraint metadata, deleting table constraints, and disclosing user preferences. An unauthenticated client can exploit these routes to execute state-mutating actions or read potentially sensitive data, significantly compromising the application's integrity. The fix addresses this issue by adding the required authentication decorator to the affected routes, ensuring proper access control.

References