CVE-2026-7820

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7820", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-05-04T21:27:01.217Z", "datePublished": "2026-05-11T14:35:53.492Z", "dateUpdated": "2026-05-11T16:04:54.699Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-05-11T14:35:53.492Z"}, "title": "pgAdmin 4: Account-lockout bypass via Flask-Security default /login view", "datePublic": "2026-05-11T10:30:00.000Z", "affected": [{"vendor": "pgadmin.org", "product": "pgAdmin 4", "repo": "https://github.com/pgadmin-org/pgadmin4", "modules": ["Authentication"], "programFiles": ["https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/model/__init__.py", "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/authenticate/__init__.py"], "versions": [{"status": "affected", "version": "0", "lessThan": "9.15", "versionType": "custom"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "Improper restriction of excessive authentication attempts (CWE-307) in pgAdmin 4.\n\npgAdmin enforces MAX_LOGIN_ATTEMPTS only inside its custom /authenticate/login view. Flask-Security's default /login view, which is registered automatically by security.init_app() and is reachable on every server, never consulted the User.locked field: pgAdmin's User model relied on Flask-Security's UserMixin.is_locked() (which always returns 'not locked') and Flask-Login's is_active (which only checks the active column, not locked). An attacker who triggered an account lockout via /authenticate/login could therefore obtain a session by re-submitting valid credentials directly to /login, defeating the brute-force-protection control for accounts using the INTERNAL authentication source. The same bypass also means that login attempts via /login are never rate-limited, so an attacker can perform an unbounded online password-guessing attack against INTERNAL accounts regardless of MAX_LOGIN_ATTEMPTS.\n\nFix overrides User.is_active and User.is_locked() so the locked column is enforced on every authentication path. LDAP, OAuth2, Kerberos, and Webserver users are not reachable by this bypass because they have no local password and are rejected by Flask-Security's LoginForm.validate before the locked check; the lockout itself is also internal-only (the /authenticate/login view filters by auth_source=INTERNAL).\n\nThis issue affects pgAdmin 4: before 9.15."}], "references": [{"url": "https://github.com/pgadmin-org/pgadmin4/issues/9904", "tags": ["issue-tracking"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "Unauthenticated network attacker. The vulnerability removes pgAdmin's brute-force-protection control for INTERNAL-auth accounts; successful authentication still requires correct credentials, so any compromise is bounded by the strength of the targeted password and the attacker's ability to guess it. C:L/I:L reflects that successful exploitation requires also winning a credential-guessing attack that the bypass enables; S:U reflects that the impact remains within the user's existing pgAdmin authority once they do log in."}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "Unauthenticated network attacker. The vulnerability removes pgAdmin's brute-force-protection control for INTERNAL-auth accounts; successful authentication still requires correct credentials, so any compromise is bounded by the strength of the targeted password and the attacker's ability to guess it. C:L/I:L reflects that successful exploitation requires also winning a credential-guessing attack that the bypass enables; S:U reflects that the impact remains within the user's existing pgAdmin authority once they do log in."}], "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Fernando Bortotti"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-307", "lang": "en", "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-11T16:04:51.073510Z", "id": "CVE-2026-7820", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-11T16:04:54.699Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7820", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-11T16:04:51.073510Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-307", "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-11T16:04:27.131Z"}}], "cna": {"title": "pgAdmin 4: Account-lockout bypass via Flask-Security default /login view", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Fernando Bortotti"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "Unauthenticated network attacker. The vulnerability removes pgAdmin's brute-force-protection control for INTERNAL-auth accounts; successful authentication still requires correct credentials, so any compromise is bounded by the strength of the targeted password and the attacker's ability to guess it. C:L/I:L reflects that successful exploitation requires also winning a credential-guessing attack that the bypass enables; S:U reflects that the impact remains within the user's existing pgAdmin authority once they do log in."}]}, {"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}, "scenarios": [{"lang": "en", "value": "Unauthenticated network attacker. The vulnerability removes pgAdmin's brute-force-protection control for INTERNAL-auth accounts; successful authentication still requires correct credentials, so any compromise is bounded by the strength of the targeted password and the attacker's ability to guess it. C:L/I:L reflects that successful exploitation requires also winning a credential-guessing attack that the bypass enables; S:U reflects that the impact remains within the user's existing pgAdmin authority once they do log in."}]}], "affected": [{"repo": "https://github.com/pgadmin-org/pgadmin4", "vendor": "pgadmin.org", "modules": ["Authentication"], "product": "pgAdmin 4", "versions": [{"status": "affected", "version": "0", "lessThan": "9.15", "versionType": "custom"}], "programFiles": ["https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/model/__init__.py", "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/authenticate/__init__.py"], "defaultStatus": "affected"}], "datePublic": "2026-05-11T10:30:00.000Z", "references": [{"url": "https://github.com/pgadmin-org/pgadmin4/issues/9904", "tags": ["issue-tracking"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Improper restriction of excessive authentication attempts (CWE-307) in pgAdmin 4.\n\npgAdmin enforces MAX_LOGIN_ATTEMPTS only inside its custom /authenticate/login view. Flask-Security's default /login view, which is registered automatically by security.init_app() and is reachable on every server, never consulted the User.locked field: pgAdmin's User model relied on Flask-Security's UserMixin.is_locked() (which always returns 'not locked') and Flask-Login's is_active (which only checks the active column, not locked). An attacker who triggered an account lockout via /authenticate/login could therefore obtain a session by re-submitting valid credentials directly to /login, defeating the brute-force-protection control for accounts using the INTERNAL authentication source. The same bypass also means that login attempts via /login are never rate-limited, so an attacker can perform an unbounded online password-guessing attack against INTERNAL accounts regardless of MAX_LOGIN_ATTEMPTS.\n\nFix overrides User.is_active and User.is_locked() so the locked column is enforced on every authentication path. LDAP, OAuth2, Kerberos, and Webserver users are not reachable by this bypass because they have no local password and are rejected by Flask-Security's LoginForm.validate before the locked check; the lockout itself is also internal-only (the /authenticate/login view filters by auth_source=INTERNAL).\n\nThis issue affects pgAdmin 4: before 9.15."}], "providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-05-11T14:35:53.492Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7820", "state": "PUBLISHED", "dateUpdated": "2026-05-11T16:04:54.699Z", "dateReserved": "2026-05-04T21:27:01.217Z", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "datePublished": "2026-05-11T14:35:53.492Z", "assignerShortName": "PostgreSQL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "modules": ["Authentication"], "product": "pgAdmin 4", "programFiles": ["https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/model/__init__.py", "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/authenticate/__init__.py"], "repo": "https://github.com/pgadmin-org/pgadmin4", "vendor": "pgadmin.org", "versions": [{"lessThan": "9.15", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:*", "matchCriteriaId": "E4868FB7-72D2-466C-B535-DD5CF92A8D5F", "versionEndExcluding": "9.15", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper restriction of excessive authentication attempts (CWE-307) in pgAdmin 4.\n\npgAdmin enforces MAX_LOGIN_ATTEMPTS only inside its custom /authenticate/login view. Flask-Security's default /login view, which is registered automatically by security.init_app() and is reachable on every server, never consulted the User.locked field: pgAdmin's User model relied on Flask-Security's UserMixin.is_locked() (which always returns 'not locked') and Flask-Login's is_active (which only checks the active column, not locked). An attacker who triggered an account lockout via /authenticate/login could therefore obtain a session by re-submitting valid credentials directly to /login, defeating the brute-force-protection control for accounts using the INTERNAL authentication source. The same bypass also means that login attempts via /login are never rate-limited, so an attacker can perform an unbounded online password-guessing attack against INTERNAL accounts regardless of MAX_LOGIN_ATTEMPTS.\n\nFix overrides User.is_active and User.is_locked() so the locked column is enforced on every authentication path. LDAP, OAuth2, Kerberos, and Webserver users are not reachable by this bypass because they have no local password and are rejected by Flask-Security's LoginForm.validate before the locked check; the lockout itself is also internal-only (the /authenticate/login view filters by auth_source=INTERNAL).\n\nThis issue affects pgAdmin 4: before 9.15."}, {"lang": "es", "value": "Restricci\u00f3n inadecuada de intentos excesivos de autenticaci\u00f3n (CWE-307) en pgAdmin 4.\n\npgAdmin aplica MAX_LOGIN_ATTEMPTS solo dentro de su vista personalizada /authenticate/login. La vista /login predeterminada de Flask-Security, que se registra autom\u00e1ticamente por security.init_app() y es accesible en cada servidor, nunca consult\u00f3 el campo User.locked: el modelo User de pgAdmin depend\u00eda de UserMixin.is_locked() de Flask-Security (que siempre devuelve \u2019not locked\u2019) y de is_active de Flask-Login (que solo verifica la columna \u2019active\u2019, no \u2019locked\u2019). Un atacante que activ\u00f3 un bloqueo de cuenta a trav\u00e9s de /authenticate/login podr\u00eda, por lo tanto, obtener una sesi\u00f3n al volver a enviar credenciales v\u00e1lidas directamente a /login, eludiendo el control de protecci\u00f3n contra fuerza bruta para cuentas que usan la fuente de autenticaci\u00f3n INTERNAL. El mismo bypass tambi\u00e9n significa que los intentos de inicio de sesi\u00f3n a trav\u00e9s de /login nunca tienen l\u00edmite de tasa, por lo que un atacante puede realizar un ataque de adivinanza de contrase\u00f1as en l\u00ednea ilimitado contra cuentas INTERNAL independientemente de MAX_LOGIN_ATTEMPTS.\n\nLa correcci\u00f3n anula User.is_active y User.is_locked() para que la columna \u2019locked\u2019 se aplique en cada ruta de autenticaci\u00f3n. Los usuarios de LDAP, OAuth2, Kerberos y Webserver no son alcanzables por este bypass porque no tienen contrase\u00f1a local y son rechazados por LoginForm.validate de Flask-Security antes de la verificaci\u00f3n de \u2019locked\u2019; el bloqueo en s\u00ed tambi\u00e9n es solo interno (la vista /authenticate/login filtra por auth_source=INTERNAL).\n\nEste problema afecta a pgAdmin 4: antes de 9.15."}], "id": "CVE-2026-7820", "lastModified": "2026-10-26T18:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7820", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-11T16:04:51.073510Z", "version": "2.0.3"}}]}, "published": "2026-05-11T16:17:39.497", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://github.com/pgadmin-org/pgadmin4/issues/9904"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-307"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,9.15)"}}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 89.0, "source": "matching"}]}, "original": {"product": "pgAdmin 4", "source": "cna", "vendor": "pgadmin.org"}, "product": "pgadmin_4", "vendor": "pgadmin"}], "created": "2026-05-11T17:00:15.796196+00:00", "updated": "2026-05-12T09:00:06.429283+00:00", "vendors": ["pgadmin", "pgadmin$PRODUCT$pgadmin_4"], "weaknesses": ["CWE-307"]}