CVE-2023-1907: pgAdmin4 Incorrect Default Permissions Vulnerability
Summary
CVE-2023-1907: pgAdmin has Incorrect Default Permissions. Affects pgadmin4 versions < 7.0. Fixed in 7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pgAdmin is a popular open-source administration and development platform for PostgreSQL, allowing users to manage databases through a web interface. It supports various authentication methods, including LDAP, which is commonly used in enterprise environments for user management. However, a vulnerability has been identified that affects users logging into pgAdmin when it is running in server mode with LDAP authentication.
Vulnerability Detail
The vulnerability arises from incorrect default permissions in pgAdmin, which can lead to session fixation issues. When multiple users attempt to log in simultaneously, there is a risk that one user may inadvertently be attached to another user's session. This could allow unauthorized access to sensitive data and actions within the pgAdmin interface, potentially compromising database security and integrity.
How To Fix
Latest published version: 9.18.0 as of 22 Oct 2026
pip install --upgrade "pgadmin4==9.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.0
This is the first release that contains the fix.
pip install --upgrade "pgadmin4==7.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to limit the number of simultaneous login attempts from the same IP address or to implement additional session management controls until the package can be updated.
Conclusion
In summary, CVE-2023-1907 is a significant vulnerability in pgAdmin that can lead to unauthorized access due to incorrect session management. Users are strongly encouraged to update to version 7.0 or later to mitigate this risk. Temporary workarounds can be implemented until the update is applied.
See every vulnerability recorded for pgadmin4 →
FAQ
CVE-2023-1907 is a vulnerability in pgAdmin that allows users to be attached to another user's session due to incorrect default permissions when using LDAP authentication.
If multiple users log in simultaneously, there is a risk that one user may gain access to another user's session, potentially compromising sensitive data.
As a temporary measure, consider limiting simultaneous login attempts or enhancing session management controls until you can apply the update.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 8.0, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for pgadmin4.
