What’s Vulnerable › Vulnerabilities

CVE-2023-1907: Pgadmin: users authenticated simultaneously via ldap may be attached to the wrong session

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-01-09 · updated 2026-06-17
• Weakness: CWE-488

Description

A vulnerability was found in pgadmin. Users logging into pgAdmin running in server mode using LDAP authentication may be attached to another user's session if multiple connection attempts occur simultaneously.

Affected products

• Pgadmin: before 7.0 — fixed in 7.0

How to fix

Upgrade to a fixed version: Pgadmin 7.0. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/security/cve/CVE-2023-1907
• https://bugzilla.redhat.com/show_bug.cgi?id=2218384

Get alerted when CVE-2023-1907 or the next vulnerability affects your stack