The vulnerability in pgweb (<=0.17.0) is due to the POST /api/connect endpoint being unprotected despite connect-backend authorization being enabled. Attackers can exploit this by providing arbitrary database connection strings and custom session identifiers, effectively bypassing intended access controls and gaining unauthorized access to databases and internal services. The CVSS 4.0 score is 8.4, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows attackers to bypass authorization controls and access unauthorized databases and internal services by supplying arbitrary connection strings and session identifiers. This can lead to unauthorized data access and potential compromise of internal resources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the pgweb interface and the /api/connect endpoint to trusted users only, and monitor for suspicious activity related to unauthorized connection attempts.