Description
A vulnerability was found in pgadmin. Users logging into pgAdmin running in server mode using LDAP authentication may be attached to another user's session if multiple connection attempts occur simultaneously.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | pgadmin | < 7.0 | 7.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | pgadmin3 | No fix yet | — |
| Ubuntu 18.04 LTS | pgadmin3 | No fix yet | — |
| Ubuntu 16.04 LTS | pgadmin3 | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | pgadmin4 | 4.30-150300.3.18.1 | SUSE-SU-2025:1326-1 |
| SLES 15 SP4 | pgadmin4 | 4.30-150300.3.18.1 | SUSE-SU-2025:1326-1 |
| SLES 15 SP3 | pgadmin4 | 4.30-150300.3.18.1 | SUSE-SU-2025:1326-1 |
| SLES 3 | pgadmin4 | 4.30-150300.3.18.1 | SUSE-SU-2025:1326-1, SUSE-SU-2025:01326-1 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | pgadmin4 | 4.30-150300.3.18.1 | SUSE-SU-2025:1326-1 |
| SLES for SAP 15 SP4 | pgadmin4 | 4.30-150300.3.18.1 | SUSE-SU-2025:1326-1 |
| SLES for SAP 15 SP3 | pgadmin4 | 4.30-150300.3.18.1 | SUSE-SU-2025:1326-1 |
| SLE HPC 15 SP5 | pgadmin4 | 4.30-150300.3.18.1 | SUSE-SU-2025:1326-1 |
| SLE HPC 15 SP4 | pgadmin4 | 4.30-150300.3.18.1 | SUSE-SU-2025:1326-1 |
| SLE HPC 15 SP3 | pgadmin4 | 4.30-150300.3.18.1 | SUSE-SU-2025:1326-1 |
| SUSE Manager Server 4.3 | pgadmin4 | 4.30-150300.3.18.1 | SUSE-SU-2025:1326-1 |
| SUSE Manager Proxy 4.3 | pgadmin4 | 4.30-150300.3.18.1 | SUSE-SU-2025:1326-1 |
| SUSE Enterprise Storage 7.1 | pgadmin4 | 4.30-150300.3.18.1 | SUSE-SU-2025:1326-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pgadmin4 | < 7.0 | 7.0 | GHSA-7w6r-748w-mh52 |
Advisories 3
- SUSE-SU-2025:01326-1 Security update for pgadmin4 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:1326-1 Security update for pgadmin4 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-0965 pgAdmin: Schwachstelle ermöglicht nicht spezifizierten Angriff BSI CERT-Bund (WID) · Aug 14, 2025
References
- https://access.redhat.com/security/cve/CVE-2023-1907 vdb-entry
- RHBZ#2218384 issue-tracking