{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-17348", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-07-25T02:52:55.455Z", "datePublished": "2026-07-31T15:59:18.714Z", "dateUpdated": "2026-07-31T17:23:08.497Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-07-31T15:59:18.714Z"}, "title": "pgAdmin 4: Missing authentication decorator on Constraints, preferences, Debugger and Schema Diff routes allows unauthenticated access in SERVER mode (incomplete fix for CVE-2026-12046)", "affected": [{"vendor": "pgadmin.org", "product": "pgAdmin 4", "repo": "https://github.com/pgadmin-org/pgadmin4", "modules": ["Constraints", "Debugger"], "programFiles": ["https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/browser/server_groups/servers/databases/schemas/tables/constraints/__init__.py", "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/tools/debugger/__init__.py"], "versions": [{"status": "affected", "version": "1.0", "lessThan": "9.17", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "pgadmin.org", "product": "pgAdmin 4", "repo": "https://github.com/pgadmin-org/pgadmin4", "modules": ["Schema Diff"], "programFiles": ["https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/tools/schema_diff/__init__.py"], "versions": [{"status": "affected", "version": "4.18", "lessThan": "9.17", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "pgadmin.org", "product": "pgAdmin 4", "repo": "https://github.com/pgadmin-org/pgadmin4", "modules": ["Preferences"], "programFiles": ["https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/preferences/__init__.py"], "versions": [{"status": "affected", "version": "8.2", "lessThan": "9.17", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's before_request hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator is reachable without authentication (CWE-306). This is the same defect class previously fixed as CVE-2026-12046 (the sqleditor close/update_connection routes).\n\nA follow-up sweep, prompted by a report describing an incomplete fix for CVE-2026-12046, found further routes missing @pga_login_required: the Constraints blueprint's nodes and proplist (object listing) routes and its delete route (a state-mutating DELETE that removes table constraints); preferences.get_all_cli (GET, discloses all CLI-settable preference values); debugger.close (DELETE); and schema_diff.close (DELETE). An unauthenticated network client could therefore enumerate constraint metadata, delete table constraints, read preference values, and force-close debugger or schema-diff sessions belonging to other users, without ever authenticating.\n\nFix adds the missing @pga_login_required decorator (and the corresponding import to the Constraints module) to each of these routes. The change is decorator-only; no behavioral changes to the underlying handlers.\n\nThis issue affects pgAdmin 4 in SERVER mode: the Constraints and Debugger routes from 1.0, the Schema Diff close route from 4.18, and preferences.get_all_cli from 8.2, all before 9.17."}], "references": [{"url": "https://github.com/pgadmin-org/pgadmin4/issues/10194", "tags": ["issue-tracking"]}, {"url": "https://github.com/pgadmin-org/pgadmin4/commit/24fdcf0f58591c87ada31366c01e1af180eceb05", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "Threat model: an unauthenticated network client sends requests directly to the affected routes on a SERVER-mode pgAdmin deployment, bypassing the login page entirely since these routes never checked for a session. No privileges or user interaction are required. Scope is Unchanged. Confidentiality is None: nodes/proplist return only constraint metadata already visible to any authenticated user of the same object, and get_all_cli discloses only CLI-settable preference toggles, not credentials or data. Integrity is Low: the delete route removes a table constraint, a real but narrow and recoverable schema change (the constraint definition can be recreated; no data rows are lost), and the close routes only terminate another user's debugger/schema-diff session state. Availability is Low, reflecting that same session-termination nuisance. This is markedly less severe than CVE-2026-12046 (the sqleditor close/update_connection routes this defect class was first fixed for), which exposed live query-session hijacking rather than bounded metadata/schema-toggle access."}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "Same reasoning as the CVSS 3.1 entry: unauthenticated, no-interaction access to routes that disclose no meaningful confidentiality-sensitive data (VC:N), make a narrow and recoverable schema change or terminate another user's tool session (VI:L/VA:L). No subsequent system beyond pgAdmin's own scope is reached, so SC:N/SI:N/SA:N."}], "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-306 Missing Authentication for Critical Function", "cweId": "CWE-306", "type": "CWE"}]}], "credits": [{"lang": "en", "value": "Hung Tran Quoc (@rampage0010)", "type": "finder"}, {"lang": "en", "value": "Dave Page <page@pgadmin.org>", "type": "remediation developer"}, {"lang": "en", "value": "Kundan Sable <kundan.sable@enterprisedb.com>", "type": "remediation reviewer"}], "source": {"discovery": "EXTERNAL"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-31T17:22:27.726914Z", "id": "CVE-2026-17348", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-31T17:23:08.497Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-17348", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-07-25T02:52:55.455Z", "datePublished": "2026-07-31T15:59:18.714Z", "dateUpdated": "2026-07-31T17:23:08.497Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-07-31T15:59:18.714Z"}, "title": "pgAdmin 4: Missing authentication decorator on Constraints, preferences, Debugger and Schema Diff routes allows unauthenticated access in SERVER mode (incomplete fix for CVE-2026-12046)", "affected": [{"vendor": "pgadmin.org", "product": "pgAdmin 4", "repo": "https://github.com/pgadmin-org/pgadmin4", "modules": ["Constraints", "Debugger"], "programFiles": ["https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/browser/server_groups/servers/databases/schemas/tables/constraints/__init__.py", "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/tools/debugger/__init__.py"], "versions": [{"status": "affected", "version": "1.0", "lessThan": "9.17", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "pgadmin.org", "product": "pgAdmin 4", "repo": "https://github.com/pgadmin-org/pgadmin4", "modules": ["Schema Diff"], "programFiles": ["https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/tools/schema_diff/__init__.py"], "versions": [{"status": "affected", "version": "4.18", "lessThan": "9.17", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "pgadmin.org", "product": "pgAdmin 4", "repo": "https://github.com/pgadmin-org/pgadmin4", "modules": ["Preferences"], "programFiles": ["https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/preferences/__init__.py"], "versions": [{"status": "affected", "version": "8.2", "lessThan": "9.17", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's before_request hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator is reachable without authentication (CWE-306). This is the same defect class previously fixed as CVE-2026-12046 (the sqleditor close/update_connection routes).\n\nA follow-up sweep, prompted by a report describing an incomplete fix for CVE-2026-12046, found further routes missing @pga_login_required: the Constraints blueprint's nodes and proplist (object listing) routes and its delete route (a state-mutating DELETE that removes table constraints); preferences.get_all_cli (GET, discloses all CLI-settable preference values); debugger.close (DELETE); and schema_diff.close (DELETE). An unauthenticated network client could therefore enumerate constraint metadata, delete table constraints, read preference values, and force-close debugger or schema-diff sessions belonging to other users, without ever authenticating.\n\nFix adds the missing @pga_login_required decorator (and the corresponding import to the Constraints module) to each of these routes. The change is decorator-only; no behavioral changes to the underlying handlers.\n\nThis issue affects pgAdmin 4 in SERVER mode: the Constraints and Debugger routes from 1.0, the Schema Diff close route from 4.18, and preferences.get_all_cli from 8.2, all before 9.17."}], "references": [{"url": "https://github.com/pgadmin-org/pgadmin4/issues/10194", "tags": ["issue-tracking"]}, {"url": "https://github.com/pgadmin-org/pgadmin4/commit/24fdcf0f58591c87ada31366c01e1af180eceb05", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "Threat model: an unauthenticated network client sends requests directly to the affected routes on a SERVER-mode pgAdmin deployment, bypassing the login page entirely since these routes never checked for a session. No privileges or user interaction are required. Scope is Unchanged. Confidentiality is None: nodes/proplist return only constraint metadata already visible to any authenticated user of the same object, and get_all_cli discloses only CLI-settable preference toggles, not credentials or data. Integrity is Low: the delete route removes a table constraint, a real but narrow and recoverable schema change (the constraint definition can be recreated; no data rows are lost), and the close routes only terminate another user's debugger/schema-diff session state. Availability is Low, reflecting that same session-termination nuisance. This is markedly less severe than CVE-2026-12046 (the sqleditor close/update_connection routes this defect class was first fixed for), which exposed live query-session hijacking rather than bounded metadata/schema-toggle access."}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "Same reasoning as the CVSS 3.1 entry: unauthenticated, no-interaction access to routes that disclose no meaningful confidentiality-sensitive data (VC:N), make a narrow and recoverable schema change or terminate another user's tool session (VI:L/VA:L). No subsequent system beyond pgAdmin's own scope is reached, so SC:N/SI:N/SA:N."}], "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-306 Missing Authentication for Critical Function", "cweId": "CWE-306", "type": "CWE"}]}], "credits": [{"lang": "en", "value": "Hung Tran Quoc (@rampage0010)", "type": "finder"}, {"lang": "en", "value": "Dave Page <page@pgadmin.org>", "type": "remediation developer"}, {"lang": "en", "value": "Kundan Sable <kundan.sable@enterprisedb.com>", "type": "remediation reviewer"}], "source": {"discovery": "EXTERNAL"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-17348", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-31T17:22:27.726914Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-31T17:23:00.482Z"}}]}}

{}

{"bugzilla": {"description": "pgadmin4: pgAdmin 4: Unauthenticated access allows data manipulation and information disclosure", "id": "2509842", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509842"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "status": "draft"}, "cwe": "CWE-306", "details": ["A flaw was found in pgAdmin 4. In SERVER mode, an unauthenticated network client could exploit missing authentication controls on specific routes. This vulnerability allows an attacker to enumerate constraint metadata, read sensitive preference values, delete table constraints, and force-close debugger or schema-diff sessions belonging to other users. This could lead to unauthorized data modification, information disclosure, and denial of service for legitimate users."], "name": "CVE-2026-17348", "public_date": "2026-07-31T15:59:18Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-17348\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-17348\nhttps://github.com/pgadmin-org/pgadmin4/commit/24fdcf0f58591c87ada31366c01e1af180eceb05\nhttps://github.com/pgadmin-org/pgadmin4/issues/10194"], "statement": "This package is not shipped in any Red Hat products, only the Fedora community project.", "threat_severity": "Moderate"}

{}