Threats tagged 'ghsa-47h8-x372-g8v3'

pgAdmin 4 versions before 9.19 had a vulnerability where, if no password file, client certificate, or client key was configured or found, the connection would fall back to using the operating system account's saved credentials. This allowed any user in server mode to connect using the service account's saved passwords or client certificate by supplying only the public certificate. The issue was fixed by explicitly setting these parameters to the user's own files or to inaccessible paths in server mode, preventing unintended credential use.