The vulnerability allows a user who does not own a shared server to clone that server via pgAdmin 4’s ad hoc connect feature. The clone inherits the original owner’s database credentials, stored as plain text, and the original ownership and sharing flags. This means the non-owner not only receives a copy of the server configuration but also the actual password needed to connect to the database, effectively granting them the same database privileges as the original owner. The weakness resides in improper handling of stored credential data and authorization controls, matching CWE‑522 and CWE‑639.

pgAdmin 4, versions beginning with 9.0 up through, but not including, 9.17. Users running these releases on any supported operating system are susceptible if they use the ad hoc connect feature on a shared server that belongs to a different user.

The CVSS score of 9.3 highlights the high severity of this flaw. The EPSS score of less than 1% indicates that exploitation is currently unlikely in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated in pgAdmin 4 and have access to a shared server owned by another user; the exploit therefore follows an authenticated, insider or co‑tenant vector. Because the flaw persists even if the connection fails, an attacker can gain credentials without triggering external network activity. The combination of a high severity score, the potential to compromise database accounts, and the lack of mitigations in older versions suggests a substantial risk for organizations that rely on shared pgAdmin 4 workspaces.