Multiple vulnerabilities affecting pgAdmin 4

pgAdmin is a PostgreSQL database management and administration tool, providing an intuitive graphical interface for creating, modifying and monitoring databases. It allows developers and administrators to efficiently manage objects, execute SQL queries, and manage roles, permissions and database access. This tool is affected by several vulnerabilities labeled as follows: CVE-2026-7813: This vulnerability results from insufficient access controls in the server mode of pgAdmin 4, affecting the Server Groups, Servers, Shared Servers, Background Processes and Debugger modules. Exploitation of this vulnerability would allow an authenticated attacker to access private servers and groups belonging to other users by guessing object identifiers, and execute arbitrary commands via the passexec_cmd field of shared servers. This vulnerability is classified critical with a severity score of 9.9 according to CVSS V3.1. CVE-2026-7814: This vulnerability is due to a lack of input validation and encoding when rendering PostgreSQL object names in the Browser Tree and the Explain Visualizer. Exploitation of this vulnerability would allow an authenticated attacker to inject and execute arbitrary JavaScript code in other users' browsers. This vulnerability is classified as high with a severity score of 7.6 according to CVSS V3.1. CVE-2026-7815: This vulnerability is due to a lack of validation of entries in the table, schema, maintenance_db and encoding parameters of the Maintenance tool. Exploitation of this vulnerability would allow an authenticated attacker to execute arbitrary SQL queries with privileges of the pgAdmin process on the affected system. This vulnerability is classified high with a severity score of 8.8 according to CVSS V3.1 CVE-2026-7816: This vulnerability is due to a lack of validation and sanitization of inputs in the Import/Export functionality. Exploitation of this vulnerability would allow an authenticated attacker to inject and execute arbitrary system commands on the server hosting pgAdmin. This vulnerability is classified as high with a severity score of 8.8 according to CVSS V3.1. CVE-2026-7817: This vulnerability is due to a lack of validation of URLs provided in LLM API configuration endpoints. Exploitation of this vulnerability would allow an authenticated attacker to read arbitrary files on the server (LFI) or coerce pgAdmin to issue requests to internal resources. This vulnerability is classified medium with a severity score of 6.5 according to CVSS V3.1. CVE-2026-7818: This vulnerability is due to insecure deserialization in the session manager. Exploitation of this vulnerability would allow an authenticated attacker to forge a malicious session file in order to execute arbitrary code remotely on the affected system. This vulnerability is classified as high with a severity score of 8.8 according to CVSS V3.1. CVE-2026-7819: This vulnerability is due to a lack of control when resolving symbolic links in the pgAdmin file manager. Exploitation of this vulnerability would allow an authenticated attacker to access arbitrary files outside of authorized directories. This vulnerability is classified as high with a severity score of 7.7 according to CVSS V3.1. CVE-2026-7820: This vulnerability is due to a lack of mechanism for limiting the number of connection attempts in the Flask-Security connection view. Exploitation of this vulnerability would allow an unauthenticated malicious actor to attempt an unlimited number of logins on a locked account, opening the door to brute force attacks. This vulnerability is classified medium with a severity score of 5.3 according to CVSS V3.1.

• All versions of pgAdmin 4 prior to version 9.15;