When pgAdmin 4 runs in server mode without explicit passwords or certificates, it falls back to the operating‑system account’s default credential files. This allows any user who can reach the pgAdmin service to authenticate to PostgreSQL servers using the service account’s stored password or simply provide a copy of the service account’s public certificate. The flaw, categorized as CWE‑1188 and CWE‑522, can result in confidentiality and integrity compromise of database contents by enabling privileged access without knowledge of the actual credentials.

The vulnerability is present in pgAdmin 4 from pgAdmin.org. All releases older than 9.19 are affected; newer versions contain the fix. The issue only applies to server mode operation, as the desktop mode is unaffected.

The CVSS score is 7.1 (High). An attacker would need access to the pgAdmin server, either through network reachability or local compromise, to exploit the flaw. The EPSS score is not available, and the vulnerability has not been listed in the CISA KEV catalog. Because libpq silently uses the service account’s credentials, the exploitation path is pragmatic: an attacker can gain database access merely by connecting to the pgAdmin service and presenting the service account’s public key or by providing no credentials at all when none are configured.