CVE-2026-116238

In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including the administrator's, in the default configuration: - Flask-Security registers its own views next to pgAdmin's. A login submitted to its /login view was checked and logged in without pgAdmin's failed login count or lock. Its /verify view checked a signed-in user's password without limit, its /change view changed a password without pgAdmin's change password permission or re-encrypting the user's saved server passwords, and its /reset views sent and applied password resets for accounts that are not internal or are locked. - The internal account was looked up by its exact username, while the login form matches the email ignoring case, so a login with the username typed in another case was neither counted nor checked for the lock. - With LDAP or webserver authentication also configured, a wrong internal password was never counted, and with Kerberos or webserver authentication configured a guess could be answered without being counted. In addition, where accounts from different authentication sources share an email address, a password reset could be sent for, or applied to, an account from another source, and the About box showed the server configuration to a user whose email was that of an administrator's account. The fix refuses submissions to Flask-Security's own views, counts every failed internal login however the username is typed and whatever other sources are configured, no longer lets a login that posts a password fall back to an authentication source that does not check it, and locks only internal authentication. Password resets and the About box act only on the user's own internal account. Desktop mode is not affected. This issue affects pgAdmin 4: before 9.19.

• CWE-307
• CWE-863

• https://github.com/pgadmin-org/pgadmin4/commit/35c9235d17a7d5a99778f01b2f1b9e5e3a3b7fde
• https://github.com/pgadmin-org/pgadmin4/commit/58c531d831179dc9b0a5bf873ccb80c71c8d387a
• https://github.com/pgadmin-org/pgadmin4/commit/c6ef41a951012cd877a1992b5dac681eec36e48d
• https://github.com/pgadmin-org/pgadmin4/issues/10676

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116232A weakness has been identified in Oray Pugongying X5 Pro 7.6…9.9
• CVE-2026-116233A security vulnerability has been detected in Oray Pugongyin…9.1
• CVE-2026-116234A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1…9.1
• CVE-2026-116235A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affec…9.1
• CVE-2026-116236A vulnerability has been found in Oray Pugongying X5 Pro 7.6…7.2
• CVE-2026-116237A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. T…8.4
• CVE-2026-116239In server mode pgAdmin 4 keeps an account per authentication…8.5
• CVE-2026-11624The Model Context Protocol has a security warning advising s…9.4
• CVE-2026-116240In server mode pgAdmin 4 validates a path into the user's st…6.5
• CVE-2026-116241pgAdmin 4's Import/Export Data tool wraps a user's query exp…9.9
• CVE-2026-116242pgAdmin 4 opens SSH tunnels with the sshtunnel library but g…8.2
• CVE-2026-116243pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from…7.5