pgAdmin 4 in SERVER mode mistakenly exposes several REST endpoints without requiring the @pga_login_required decorator, allowing any network user to reach these routes. The affected endpoints let an unauthenticated client enumerate table constraints, delete constraints, read command‑line preference values, and abruptly terminate active debugger or schema‑diff sessions. As a result, an attacker can modify database schema metadata, leak configuration data, and disrupt user sessions without providing credentials, effectively gaining unauthorized control over those privileged operations.

The vulnerability is present in pgAdmin 4 server deployments running any release prior to 9.17. The specific routes impacted are the Constraints blueprint (nodes, proplist, and delete), the preferences.get_all_cli endpoint, the debugger.close endpoint, and the schema_diff.close endpoint. These endpoints exist across pgAdmin 4 versions 1.0, 4.18, 8.2 and earlier, regardless of the installed database version, because the missing decorator logic is a code‑level oversight.

With a CVSS score of 6.9, the vulnerability is considered moderate. The EPSS score is listed as less than 1 %, indicating a very low probability of exploitation seen in the wild. The attack requires lateral or direct network access to the pgAdmin 4 server and does not rely on any authenticated session. Despite the low exploitation likelihood, the lack of authentication for these operations means that a present user could perform destructive changes without any credentials, and the absence of a KEV listing implies no known large‑scale campaigns yet.