In pgAdmin 4 versions 9.0 up to but not including 9.17, the Workspaces feature's adhoc connect server endpoint clones an existing server record including sensitive ownership and credential fields such as user_id, shared flags, and stored passwords. When a non-owner triggers this clone on another user's shared server, the cloned server inherits the original owner's credentials and ownership, granting the non-owner unauthorized database access with the source user's privileges. The cloned record persists even if the connection attempt fails. The vulnerability is addressed by forcing the cloned record's ownership and credential fields to be assigned to the calling user and clearing stored credentials before committing the clone.

An attacker with limited privileges (non-owner with at least some access) can exploit this vulnerability to gain unauthorized access to database credentials belonging to other users, including administrators. This leads to an authorization bypass and privilege escalation within the database environment, potentially allowing the attacker to perform actions with the elevated privileges of the compromised credentials. The vulnerability does not impact availability but has high confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has described a fix that forces cloned adhoc server records to belong to the calling user with cleared stored credentials before saving, preventing unauthorized credential inheritance. Users of affected versions (9.0 through before 9.17) should monitor pgAdmin.org for an official patch or update to a fixed version once released. Until then, restrict adhoc connect permissions to trusted users only.