CVE-2026-91924

pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary database connection strings. Attackers can bypass the resource-to-database mapping by providing a custom session identifier and connection...

EUVD-2026-78415

pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary database connection strings. Attackers can bypass the resource-to-database mapping by providing a custom session identifier and connection...

CVE-2026-91924 pgweb through 0.17.0 Missing Authorization on Direct Connect Endpoint

pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary database connection strings. Attackers can bypass the resource-to-database mapping by providing a custom session identifier and connection...

CVE-2026-91924

pgweb versions through 0.17.0 leave the POST /api/connect endpoint unguarded when connect-backend authorization is configured. This allows an attacker with low privileges to supply an arbitrary database connection string, bypassing the intended resource-to-database mapping by providing a custom s...

CVE-2026-91924 pgweb through 0.17.0 Missing Authorization on Direct Connect Endpoint

pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary database connection strings. Attackers can bypass the resource-to-database mapping by providing a custom session identifier and connection...

CVE-2026-91924 pgweb through 0.17.0 Missing Authorization on Direct Connect Endpoint

pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary database connection strings. Attackers can bypass the resource-to-database mapping by providing a custom session identifier and connection...

CVE-2026-91924: Missing Authorization

pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary database connection strings. Attackers can bypass the resource-to-database mapping by providing a custom session identifier and connection...

PT-2026-91929

Name of the Vulnerable Software and Affected Versions pgweb versions prior to 0.17.1 Description The application fails to implement authorization checks on the 'POST /api/connect' endpoint when connect-backend authorization is configured. This allows an attacker to bypass the resource-to-database...