{"id":"CVE-2026-116251","kind":"vulnerability","aliases":["CVE-2026-116251"],"related":[],"title":"pgAdmin 4: old sessions stay valid after a password change","description":"pgAdmin 4 did not invalidate a user's existing sessions when their password changed, either through the user's own change password dialog or through an administrator resetting it in User Management. A session established before the change, for example on another device or by someone who had obtained the old password or a session cookie, therefore stayed logged in after the change, which is the step a user or administrator takes precisely to cut such access off. It remained usable until it expired.\n\nThe fix rotates the user's session identifier (fs_uniquifier) whenever the password is changed, so every other session of that user is logged out. The session that made the change is logged in again and keeps its database connections. Saved server passwords, including those for shared servers, are re-encrypted under the new key; any that cannot be decrypted are cleared and the user is told. If re-encryption fails, the sessions are still revoked and the saved passwords are cleared rather than the change failing.\n\nThis issue affects pgAdmin 4: before 9.19.","summary":"pgAdmin 4 kept a user's existing login sessions active after that user's password was changed, whether by the user or by an administrator. Someone holding an old session or cookie could keep using pgAdmin until the session expired.","severity":"medium","cvss":4.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","pgadmin","postgresql","self-hosted"],"not_affected_if":["pgadmin-9.19-or-later","single-user-desktop"],"how_to_check":"- Check the installed pgAdmin 4 version; the sources say versions before `9.19` are affected.\n- Confirm whether your pgAdmin instance is reachable by users who could have shared sessions or cookies.","fix":"- pgAdmin 4: move to `9.19` or later, per the sources.","status":"open","published_at":"2026-10-30T20:17:05+00:00","first_seen_at":"2026-10-30T20:25:37+00:00","triaged_at":"2026-10-30T20:26:54+00:00","updated_at":"2026-10-30T20:26:54+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T20:26:54Z","model":"claude-haiku-5-5","output":{"fix":"- pgAdmin 4: move to `9.19` or later, per the sources.","reach":"network","title":"pgAdmin 4: old sessions stay valid after a password change","impact":"medium","summary":"pgAdmin 4 kept a user's existing login sessions active after that user's password was changed, whether by the user or by an administrator. Someone holding an old session or cookie could keep using pgAdmin until the session expired.","audience":"businesses","category":"package","nicknames":[],"who_cares":["pgadmin","postgresql","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"old sessions keep access to pgAdmin after password change","analyst_note":"","how_to_check":"- Check the installed pgAdmin 4 version; the sources say versions before `9.19` are affected.\n- Confirm whether your pgAdmin instance is reachable by users who could have shared sessions or cookies.","plain_action":"","needs_analyst":false,"not_affected_if":["pgadmin-9.19-or-later","single-user-desktop"],"who_is_affected":"Teams running pgAdmin 4 before version 9.19 as a shared web administration tool for PostgreSQL. Exposure matters most where users log in from several devices or where administrators reset passwords to cut off access. Instances already on 9.19 or later are not affected by this issue.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000689,"input_tokens":4326,"output_tokens":513,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116251':13A,16A '-2026':12A,15A '4':2A,24B,64C,240C '9.19':242C 'access':139C 'activ':32B 'administr':47B,89C,133C 'affect':238C 'anoth':104C 'cannot':205C 'chang':10A,39B,76C,83C,100C,125C,161C,177C,234C 'clear':209C,230C 'connect':186C 'cooki':54B,118C 'could':55B 'cut':137C 'cve':11A,14A 'databas':185C 'decrypt':207C 'devic':105C 'dialog':85C 'either':77C 'encrypt':198C,218C 'establish':97C 'everi':163C 'exampl':102C 'exist':29B,71C 'expir':62B,146C 'fail':219C,235C 'fix':148C 'fs':155C 'hold':49B 'host':22B 'identifi':154C 'includ':190C 'invalid':67C 'issu':237C 'keep':56B,183C 'kept':25B 'key':202C 'log':121C,170C,179C 'login':30B 'made':175C 'manag':94C 'new':201C 'obtain':111C 'old':3A,51B,113C 'packag':17B 'password':9A,37B,75C,84C,114C,159C,189C,228C 'pgadmin':1A,18B,23B,58B,63C,239C 'postgresql':19B 'precis':135C 'rather':231C 're':197C,217C 're-encrypt':196C,216C 'remain':142C 'reset':90C 'revok':224C 'rotat':149C 'save':187C,227C 'self':21B 'self-host':20B 'server':188C,194C 'session':4A,31B,52B,61B,72C,96C,117C,153C,165C,173C,221C 'share':193C 'someon':48B,108C 'stay':5A,120C 'step':129C 'still':223C 'take':134C 'therefor':119C 'told':214C 'uniquifi':156C 'usabl':143C 'use':57B 'user':27B,35B,43B,69C,80C,93C,131C,151C,168C,212C 'valid':6A 'whenev':157C 'whether':40B","nicknames":[],"mitigations":[],"who_affected":"Teams running pgAdmin 4 before version 9.19 as a shared web administration tool for PostgreSQL. Exposure matters most where users log in from several devices or where administrators reset passwords to cut off access. Instances already on 9.19 or later are not affected by this issue.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T20:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116251","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116251","severity":null,"published_at":"2026-10-30T20:17:05+00:00","modified_at":"2026-10-30T20:17:05+00:00","first_seen_at":"2026-10-30T20:25:37+00:00","fetched_at":"2026-10-30T20:25:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}