23 Oct 2026 15:48:27 UTC
pgweb through 0.17.0 Missing Authorization on Direct Connect Endpoint
cve-program · CVE-2026-91924 · Published
CVE-2026-91924
pgweb through 0.17.0 Missing Authorization on Direct Connect Endpoint
CVSS 4.0 8.4 HIGHCVSS 3.1 8.5 HIGHCheck source for fixed versionsKEV status unknown
Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.
cve-program · CVE-2026-91924
Publishedpgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary database connection strings. Attackers can bypass the resource-to-database mapping by providing a custom session identifier and connection URL to access unauthorized databases and internal services.
Read the publisher's advisoryAffected versions, risk and source history
Advisory history
1 saved versionsSee how the publisher's advisory changed over time. Each link opens the version saved at that time. The publisher's update date can differ from the date shown here.
How advisory history works
Each link identifies one complete publisher record. History can include advisories that previously shared an identifier; an identifier removed by a publisher no longer establishes a current relationship. A historical link shows only that record and earlier saved versions. Failed checks and unchanged reads do not create new versions.
This historical link shows only this version and versions saved before it. Browse all advisory history.