CVE-2026-116238

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116238", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-10-25T16:26:16.419Z", "datePublished": "2026-10-30T19:55:11.056Z", "dateUpdated": "2026-11-06T16:06:41.395Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-10-30T19:55:11.056Z"}, "title": "pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks", "datePublic": "2026-10-29T00:00:00.000Z", "affected": [{"vendor": "pgadmin.org", "product": "pgAdmin 4", "repo": "https://github.com/pgadmin-org/pgadmin4", "modules": ["Authentication", "Password Recovery", "User Management"], "programFiles": ["https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/__init__.py", "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/authenticate/__init__.py", "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/browser/__init__.py", "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/about/__init__.py"], "versions": [{"status": "affected", "version": "0", "lessThan": "9.19", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including the administrator's, in the default configuration:\n\n- Flask-Security registers its own views next to pgAdmin's. A login submitted to its /login view was checked and logged in without pgAdmin's failed login count or lock. Its /verify view checked a signed-in user's password without limit, its /change view changed a password without pgAdmin's change password permission or re-encrypting the user's saved server passwords, and its /reset views sent and applied password resets for accounts that are not internal or are locked.\n- The internal account was looked up by its exact username, while the login form matches the email ignoring case, so a login with the username typed in another case was neither counted nor checked for the lock.\n- With LDAP or webserver authentication also configured, a wrong internal password was never counted, and with Kerberos or webserver authentication configured a guess could be answered without being counted.\n\nIn addition, where accounts from different authentication sources share an email address, a password reset could be sent for, or applied to, an account from another source, and the About box showed the server configuration to a user whose email was that of an administrator's account.\n\nThe fix refuses submissions to Flask-Security's own views, counts every failed internal login however the username is typed and whatever other sources are configured, no longer lets a login that posts a password fall back to an authentication source that does not check it, and locks only internal authentication. Password resets and the About box act only on the user's own internal account. Desktop mode is not affected.\n\nThis issue affects pgAdmin 4: before 9.19."}], "references": [{"url": "https://github.com/pgadmin-org/pgadmin4/issues/10676", "tags": ["issue-tracking"]}, {"url": "https://github.com/pgadmin-org/pgadmin4/commit/58c531d831179dc9b0a5bf873ccb80c71c8d387a", "tags": ["patch"]}, {"url": "https://github.com/pgadmin-org/pgadmin4/commit/35c9235d17a7d5a99778f01b2f1b9e5e3a3b7fde", "tags": ["patch"]}, {"url": "https://github.com/pgadmin-org/pgadmin4/commit/c6ef41a951012cd877a1992b5dac681eec36e48d", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "Scored for the worst variant, which needs no account and no special configuration: unlimited password guesses against an internal account, including the administrator's, through Flask-Security's own login view or a username typed in another case. Attack Complexity is High because success still depends on guessing the account's password. A guessed account gives that account's access to pgAdmin, so Confidentiality, Integrity and Availability are High (an administrator can create, change and delete users). Scope is Unchanged: the flaw removes the limit on guesses; any impact beyond pgAdmin follows only from a password the attacker has guessed."}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "Same reasoning as the CVSS 3.1 entry. AC:H and AT:P because success depends on guessing a password. VC:H/VI:H/VA:H for the guessed pgAdmin account; no subsequent-system impact is claimed."}], "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 9.2, "baseSeverity": "CRITICAL"}}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts", "cweId": "CWE-307", "type": "CWE"}, {"lang": "en", "description": "CWE-863 Incorrect Authorization", "cweId": "CWE-863", "type": "CWE"}]}], "credits": [{"lang": "en", "value": "Ashesh Vashi <ashesh.vashi@enterprisedb.com>", "type": "remediation developer"}], "source": {"discovery": "INTERNAL"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-06T16:06:27.167452Z", "id": "CVE-2026-116238", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T16:06:41.395Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-116238", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-06T16:06:27.167452Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T16:06:36.084Z"}}], "cna": {"title": "pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks", "source": {"discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "remediation developer", "value": "Ashesh Vashi <ashesh.vashi@enterprisedb.com>"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "Scored for the worst variant, which needs no account and no special configuration: unlimited password guesses against an internal account, including the administrator's, through Flask-Security's own login view or a username typed in another case. Attack Complexity is High because success still depends on guessing the account's password. A guessed account gives that account's access to pgAdmin, so Confidentiality, Integrity and Availability are High (an administrator can create, change and delete users). Scope is Unchanged: the flaw removes the limit on guesses; any impact beyond pgAdmin follows only from a password the attacker has guessed."}]}, {"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 9.2, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}, "scenarios": [{"lang": "en", "value": "Same reasoning as the CVSS 3.1 entry. AC:H and AT:P because success depends on guessing a password. VC:H/VI:H/VA:H for the guessed pgAdmin account; no subsequent-system impact is claimed."}]}], "affected": [{"repo": "https://github.com/pgadmin-org/pgadmin4", "vendor": "pgadmin.org", "modules": ["Authentication", "Password Recovery", "User Management"], "product": "pgAdmin 4", "versions": [{"status": "affected", "version": "0", "lessThan": "9.19", "versionType": "custom"}], "programFiles": ["https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/__init__.py", "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/authenticate/__init__.py", "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/browser/__init__.py", "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/about/__init__.py"], "defaultStatus": "unaffected"}], "datePublic": "2026-10-29T00:00:00.000Z", "references": [{"url": "https://github.com/pgadmin-org/pgadmin4/issues/10676", "tags": ["issue-tracking"]}, {"url": "https://github.com/pgadmin-org/pgadmin4/commit/58c531d831179dc9b0a5bf873ccb80c71c8d387a", "tags": ["patch"]}, {"url": "https://github.com/pgadmin-org/pgadmin4/commit/35c9235d17a7d5a99778f01b2f1b9e5e3a3b7fde", "tags": ["patch"]}, {"url": "https://github.com/pgadmin-org/pgadmin4/commit/c6ef41a951012cd877a1992b5dac681eec36e48d", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including the administrator's, in the default configuration:\n\n- Flask-Security registers its own views next to pgAdmin's. A login submitted to its /login view was checked and logged in without pgAdmin's failed login count or lock. Its /verify view checked a signed-in user's password without limit, its /change view changed a password without pgAdmin's change password permission or re-encrypting the user's saved server passwords, and its /reset views sent and applied password resets for accounts that are not internal or are locked.\n- The internal account was looked up by its exact username, while the login form matches the email ignoring case, so a login with the username typed in another case was neither counted nor checked for the lock.\n- With LDAP or webserver authentication also configured, a wrong internal password was never counted, and with Kerberos or webserver authentication configured a guess could be answered without being counted.\n\nIn addition, where accounts from different authentication sources share an email address, a password reset could be sent for, or applied to, an account from another source, and the About box showed the server configuration to a user whose email was that of an administrator's account.\n\nThe fix refuses submissions to Flask-Security's own views, counts every failed internal login however the username is typed and whatever other sources are configured, no longer lets a login that posts a password fall back to an authentication source that does not check it, and locks only internal authentication. Password resets and the About box act only on the user's own internal account. Desktop mode is not affected.\n\nThis issue affects pgAdmin 4: before 9.19."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-307", "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts"}, {"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-10-30T19:55:11.056Z"}}}, "cveMetadata": {"cveId": "CVE-2026-116238", "state": "PUBLISHED", "dateUpdated": "2026-11-06T16:06:41.395Z", "dateReserved": "2026-10-25T16:26:16.419Z", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "datePublished": "2026-10-30T19:55:11.056Z", "assignerShortName": "PostgreSQL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Authentication", "Password Recovery", "User Management"], "product": "pgAdmin 4", "programFiles": ["https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/__init__.py", "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/authenticate/__init__.py", "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/browser/__init__.py", "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/about/__init__.py"], "repo": "https://github.com/pgadmin-org/pgadmin4", "vendor": "pgadmin.org", "versions": [{"lessThan": "9.19", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:*:*:*", "matchCriteriaId": "320E46B0-BBE2-47FD-955F-986EC9930403", "versionEndExcluding": "9.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including the administrator's, in the default configuration:\n\n- Flask-Security registers its own views next to pgAdmin's. A login submitted to its /login view was checked and logged in without pgAdmin's failed login count or lock. Its /verify view checked a signed-in user's password without limit, its /change view changed a password without pgAdmin's change password permission or re-encrypting the user's saved server passwords, and its /reset views sent and applied password resets for accounts that are not internal or are locked.\n- The internal account was looked up by its exact username, while the login form matches the email ignoring case, so a login with the username typed in another case was neither counted nor checked for the lock.\n- With LDAP or webserver authentication also configured, a wrong internal password was never counted, and with Kerberos or webserver authentication configured a guess could be answered without being counted.\n\nIn addition, where accounts from different authentication sources share an email address, a password reset could be sent for, or applied to, an account from another source, and the About box showed the server configuration to a user whose email was that of an administrator's account.\n\nThe fix refuses submissions to Flask-Security's own views, counts every failed internal login however the username is typed and whatever other sources are configured, no longer lets a login that posts a password fall back to an authentication source that does not check it, and locks only internal authentication. Password resets and the About box act only on the user's own internal account. Desktop mode is not affected.\n\nThis issue affects pgAdmin 4: before 9.19."}], "id": "CVE-2026-116238", "lastModified": "2026-11-09T15:45:22.937", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116238", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T16:06:27.167452Z", "version": "2.0.3"}}]}, "published": "2026-10-30T20:17:02.433", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "tags": ["Patch"], "url": "https://github.com/pgadmin-org/pgadmin4/commit/35c9235d17a7d5a99778f01b2f1b9e5e3a3b7fde"}, {"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "tags": ["Patch"], "url": "https://github.com/pgadmin-org/pgadmin4/commit/58c531d831179dc9b0a5bf873ccb80c71c8d387a"}, {"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "tags": ["Patch"], "url": "https://github.com/pgadmin-org/pgadmin4/commit/c6ef41a951012cd877a1992b5dac681eec36e48d"}, {"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/pgadmin-org/pgadmin4/issues/10676"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-307"}, {"lang": "en", "value": "CWE-863"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}

{"bugzilla": {"description": "pgadmin4: pgadmin4: Account takeover via account lockout bypass", "id": "2568334", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2568334"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-307", "details": ["In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including the administrator's, in the default configuration:\n- Flask-Security registers its own views next to pgAdmin's. A login submitted to its /login view was checked and logged in without pgAdmin's failed login count or lock. Its /verify view checked a signed-in user's password without limit, its /change view changed a password without pgAdmin's change password permission or re-encrypting the user's saved server passwords, and its /reset views sent and applied password resets for accounts that are not internal or are locked.\n- The internal account was looked up by its exact username, while the login form matches the email ignoring case, so a login with the username typed in another case was neither counted nor checked for the lock.\n- With LDAP or webserver authentication also configured, a wrong internal password was never counted, and with Kerberos or webserver authentication configured a guess could be answered without being counted.\nIn addition, where accounts from different authentication sources share an email address, a password reset could be sent for, or applied to, an account from another source, and the About box showed the server configuration to a user whose email was that of an administrator's account.\nThe fix refuses submissions to Flask-Security's own views, counts every failed internal login however the username is typed and whatever other sources are configured, no longer lets a login that posts a password fall back to an authentication source that does not check it, and locks only internal authentication. Password resets and the About box act only on the user's own internal account. Desktop mode is not affected.\nThis issue affects pgAdmin 4: before 9.19.", "A flaw was found in pgAdmin 4 when operating in server mode. The application fails to properly enforce failed login limits on internal accounts due to exposed framework authentication endpoints, case-sensitivity discrepancies during username matching, and improper handling of multiple authentication sources. An unauthenticated remote attacker can exploit these weaknesses to bypass account lockout controls and conduct unlimited brute-force password guessing attacks. Successful exploitation can lead to account takeover, granting unauthorized access to internal user and administrator accounts."], "mitigation": {"lang": "en:us", "value": "Restrict access to the pgAdmin 4 web service to trusted management networks or localhost:\n1. Remove general public access to the port running pgAdmin (for example, port 5050 or HTTP/HTTPS ports):\nfirewall-cmd --permanent --remove-port=5050/tcp\n2. Restrict incoming connections to trusted administrator subnets:\nfirewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"192.168.1.0/24\" port port=\"5050\" protocol=\"tcp\" accept'\n3. Reload the firewall to apply rules:\nfirewall-cmd --reload\nWarning: Reloading firewall rules will alter active network filtering policies and may disrupt existing connections or block administrative access if the source subnet is incorrectly specified.\nAlternatively, if central multi-user access is not required, run pgAdmin 4 exclusively in desktop mode. Where an external reverse proxy (such as Apache HTTP Server or NGINX) is deployed in front of pgAdmin, enforce rate-limiting rules and IP filtering on authentication endpoints to mitigate automated brute-force attempts."}, "name": "CVE-2026-116238", "public_date": "2026-10-30T19:55:11Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116238\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116238\nhttps://github.com/pgadmin-org/pgadmin4/commit/35c9235d17a7d5a99778f01b2f1b9e5e3a3b7fde\nhttps://github.com/pgadmin-org/pgadmin4/commit/58c531d831179dc9b0a5bf873ccb80c71c8d387a\nhttps://github.com/pgadmin-org/pgadmin4/commit/c6ef41a951012cd877a1992b5dac681eec36e48d\nhttps://github.com/pgadmin-org/pgadmin4/issues/10676"], "statement": "Red Hat rates the severity of this vulnerability as Important because unauthenticated remote attackers can circumvent failed login thresholds to conduct unrestricted password brute-forcing against administrative users, potentially resulting in full compromise of the database management console. The issue specifically threatens environments running pgAdmin 4 in multi-user server mode, whereas local standalone desktop installations remain unaffected. Although an exploit requires successfully guessing valid credentials, exposing authentication endpoints over public or untrusted networks significantly increases the risk of account takeover.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,9.19)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "pgAdmin 4", "source": "cna", "vendor": "pgadmin.org"}, "product": "pgadmin_4", "vendor": "pgadmin"}], "created": "2026-10-30T21:30:12.512424+00:00", "updated": "2026-10-30T22:45:14.058837+00:00", "vendors": ["pgadmin", "pgadmin$PRODUCT$pgadmin_4"]}