In pgAdmin 4 server mode prior to version 9.19, non-administrator users could improperly share database servers with all users. This vulnerability allowed any user able to register a server to mark it as shared, despite the interface restricting this action to administrators. Although shared servers carry no credentials, this flaw enables a user to plant a server entry named to appear trusted in other users' server trees, potentially tricking them into connecting and exposing their database passwords to an attacker-controlled host. The issue was fixed by rejecting non-administrator requests to share servers, pruning shared entries from non-administrators during import, and warning about previously shared servers at startup.