Role-Based Tool Permissions Flaw in pgAdmin 4 by pgAdmin Team

CVE-2026-17350

What is CVE-2026-17350?

An authorization flaw exists in pgAdmin 4's role-based tool permissions system, which allows users with a valid login to bypass restrictions for specific tools. Although permission checks are enforced at entry points, backend routes and Socket.IO handlers lacked consistent permission validation, enabling unauthorized access to sensitive operations. For instance, users denied tool-specific permissions could still execute commands and access data through less protected routes and channels. This oversight poses a significant risk, as it undermines the intended separation of duties enforced by database administrators. The issue has been addressed by implementing proper permission checks across all relevant routes and handlers.

References