{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Authentication",
            "Password Recovery",
            "User Management"
          ],
          "product": "pgAdmin 4",
          "programFiles": [
            "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/__init__.py",
            "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/authenticate/__init__.py",
            "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/browser/__init__.py",
            "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/about/__init__.py"
          ],
          "repo": "https://github.com/pgadmin-org/pgadmin4",
          "vendor": "pgadmin.org",
          "versions": [
            {
              "lessThan": "9.19",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Ashesh Vashi \u003cashesh.vashi@enterprisedb.com\u003e"
        }
      ],
      "datePublic": "2026-10-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including the administrator\u0027s, in the default configuration:\n\n- Flask-Security registers its own views next to pgAdmin\u0027s. A login submitted to its /login view was checked and logged in without pgAdmin\u0027s failed login count or lock. Its /verify view checked a signed-in user\u0027s password without limit, its /change view changed a password without pgAdmin\u0027s change password permission or re-encrypting the user\u0027s saved server passwords, and its /reset views sent and applied password resets for accounts that are not internal or are locked.\n- The internal account was looked up by its exact username, while the login form matches the email ignoring case, so a login with the username typed in another case was neither counted nor checked for the lock.\n- With LDAP or webserver authentication also configured, a wrong internal password was never counted, and with Kerberos or webserver authentication configured a guess could be answered without being counted.\n\nIn addition, where accounts from different authentication sources share an email address, a password reset could be sent for, or applied to, an account from another source, and the About box showed the server configuration to a user whose email was that of an administrator\u0027s account.\n\nThe fix refuses submissions to Flask-Security\u0027s own views, counts every failed internal login however the username is typed and whatever other sources are configured, no longer lets a login that posts a password fall back to an authentication source that does not check it, and locks only internal authentication. Password resets and the About box act only on the user\u0027s own internal account. Desktop mode is not affected.\n\nThis issue affects pgAdmin 4: before 9.19."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "Scored for the worst variant, which needs no account and no special configuration: unlimited password guesses against an internal account, including the administrator\u0027s, through Flask-Security\u0027s own login view or a username typed in another case. Attack Complexity is High because success still depends on guessing the account\u0027s password. A guessed account gives that account\u0027s access to pgAdmin, so Confidentiality, Integrity and Availability are High (an administrator can create, change and delete users). Scope is Unchanged: the flaw removes the limit on guesses; any impact beyond pgAdmin follows only from a password the attacker has guessed."
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "Same reasoning as the CVSS 3.1 entry. AC:H and AT:P because success depends on guessing a password. VC:H/VI:H/VA:H for the guessed pgAdmin account; no subsequent-system impact is claimed."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-307",
              "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T19:55:11.056Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/pgadmin-org/pgadmin4/issues/10676"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/pgadmin-org/pgadmin4/commit/58c531d831179dc9b0a5bf873ccb80c71c8d387a"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/pgadmin-org/pgadmin4/commit/35c9235d17a7d5a99778f01b2f1b9e5e3a3b7fde"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/pgadmin-org/pgadmin4/commit/c6ef41a951012cd877a1992b5dac681eec36e48d"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "pgAdmin 4: The failed login limit can be bypassed, and Flask-Security\u0027s own views skip pgAdmin\u0027s login and password checks"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-116238",
    "datePublished": "2026-10-30T19:55:11.056Z",
    "dateReserved": "2026-10-25T16:26:16.419Z",
    "dateUpdated": "2026-10-30T19:55:11.056Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}