The vulnerability allows a non‑administrator to submit a create or update request for a server that marks it as shared with all users, even though the shared switch is only visible to administrators. Because this flag and the associated username are stored, any user can register a server that is then displayed in every other user’s tree, pointing to a host controlled by the attacker. Since the shared server holds no credentials, the attacker gains no direct access to the target database, but users who connect to the shared server expose their database passwords to the attacker’s host. This can lead to credential compromise and potential lateral movement within the organization’s database environment.

pgAdmin 4 (vendor pgadmin.org) versions prior to 9.19. The affected components are the server mode API endpoints for creating and updating servers and the servers.json import functionality that processes shared server entries.

The CVSS score of 6 indicates medium severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV, suggesting no known large‑scale exploits at the time of this analysis. However, the attack path requires only that an attacker has a non‑administrator account in pgAdmin 4; no additional technical expertise is needed beyond using the standard user interface or API. Because the flaw permits planting a trusted‑named server in every user’s view, the exploitation impact is wide, potentially affecting all users of an installation. The risk is therefore moderate to high, especially in environments with many users sharing a common pgAdmin instance.