CVE-2023-1907: pgAdmin4 Incorrect Default Permissions Vulnerability
Summary
CVE-2023-1907: pgAdmin has Incorrect Default Permissions. Affects pgadmin4 versions < 7.0. Fixed in 7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pgAdmin is a popular open-source administration and development platform for PostgreSQL, designed to manage database operations through a web interface. It supports various authentication methods, including LDAP, allowing users to log in and manage their databases efficiently. However, a recent vulnerability has been identified that affects users logging into pgAdmin running in server mode using LDAP authentication, potentially compromising user sessions.
Vulnerability Detail
The vulnerability arises from incorrect default permissions in pgAdmin, which can lead to session fixation issues. When multiple users attempt to log in simultaneously, there is a risk that one user may inadvertently attach to another user's session. This can result in unauthorized access to sensitive data and actions within the pgAdmin interface, posing a significant security threat.
How To Fix
Latest published version: 9.18.0 as of 22 Oct 2026
pip install --upgrade "pgadmin4==9.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.0
This is the first release that contains the fix.
pip install --upgrade "pgadmin4==7.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to limit the number of simultaneous login attempts to the pgAdmin server. This can be managed by implementing session management practices or configuring the server to restrict concurrent logins.
Conclusion
The CVE-2023-1907 vulnerability in pgAdmin4 highlights the importance of maintaining updated software to prevent unauthorized access through session fixation. Users are encouraged to update to version 7.0 or later and implement best practices for session management.
See every vulnerability recorded for pgadmin4 →
FAQ
CVE-2023-1907 is a vulnerability in pgAdmin4 that allows users to inadvertently attach to another user's session when logging in using LDAP authentication.
The risks include unauthorized access to user sessions, which can lead to exposure of sensitive data and unauthorized actions within the pgAdmin interface.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 8.0, indicating a high severity level.
Vulert provides real-time monitoring and alerts for open-source vulnerabilities using just the Pipfile.lock, helping you stay informed about potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for pgadmin4.
