{"id":"CVE-2024-4215","aliases":["EUVD-2024-1364","GHSA-2mvc-557g-5638","PYSEC-2026-1768","SUSE-SU-2024:2260-1","openSUSE-SU-2024:14052-1"],"status":"published","title":"The Multi Factor Authentication bypass vulnerability in pgAdmin 4","description":"pgAdmin \u003c= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’s username and password may authenticate to the application and perform sensitive actions within the application, such as managing files and executing SQL queries, regardless of the account’s MFA enrollment status.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00634,"percentile":0.50846,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2024-05-02T17:42:34Z","modified":"2026-10-28T02:30:59Z","fixes":[{"ecosystem":"PyPI","package":"pgadmin4","fixed_in":["8.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"8.5"},{"fixed":"8.6"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6"}]}],"versions":["4.20","4.22","4.23","4.24","4.25","4.26","4.27","4.28","4.29","4.30","5.0","5.1","5.2","5.3","5.4","5.5","5.6","5.7","6.10","6.11","6.12","6.13","6.14","6.15","6.16","6.17","6.18","6.19","6.2","6.20","6.21","6.3","6.4","6.5","6.6","6.7","6.8","6.9","7.0","7.1","7.2","7.3","7.4","7.5","7.6","7.7","7.8","8.0","8.1","8.2","8.3","8.4","8.5"]},{"source":"osv","ecosystem":"PyPI","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6"}]}],"versions":["4.20","4.22","4.23","4.24","4.25","4.26","4.27","4.28","4.29","4.30","5.0","5.1","5.2","5.3","5.4","5.5","5.6","5.7","6.10","6.11","6.12","6.13","6.14","6.15","6.16","6.17","6.18","6.19","6.2","6.20","6.21","6.3","6.4","6.5","6.6","6.7","6.8","6.9","7.0","7.1","7.2","7.3","7.4","7.5","7.6","7.7","7.8","8.0","8.1","8.2","8.3","8.4","8.5"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5-150600.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5-150600.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8-1.1"}]}],"bundled":2}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"pgadmin","product":"pgadmin_4"},{"vendor":"pgadmin.org","product":"pgadmin 4"},{"vendor":"postgresql","product":"pgadmin"}],"references":[{"url":"https://github.com/pgadmin-org/pgadmin4/issues/7425","tags":["issue-tracking","x_transferred","Issue Tracking","report","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE/","tags":["x_transferred","Mailing List","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4215","tags":["advisory"]},{"url":"https://github.com/pgadmin-org/pgadmin4/commit/f4761f55f7cf6d56d6c5129f921393b0b47fd976","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2mvc-557g-5638","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/4xxx/CVE-2024-4215.json","tags":["advisory"]},{"url":"https://github.com/pgadmin-org/pgadmin4","tags":["package"]},{"url":"https://pypi.org/project/pgadmin4","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242260-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1223867","tags":["report"]},{"url":"https://bugzilla.suse.com/1223868","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4215","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4216","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-4215","title":"The Multi Factor Authentication bypass vulnerability in pgAdmin 4","description":"pgAdmin \u003c= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’s username and password may authenticate to the application and perform sensitive actions within the application, such as managing files and executing SQL queries, regardless of the account’s MFA enrollment status.","status":"published","published":"2024-05-02T17:42:34.88Z","modified":"2025-02-13T17:53:30.48Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:34:16.78507Z"}],"euvd":[{"id":"EUVD-2024-1364","description":"pgAdmin \u003c= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’s username and password may authenticate to the application and perform sensitive actions within the application, such as managing files and executing SQL queries, regardless of the account’s MFA enrollment status.","status":"published","published":"2024-05-02T17:42:34Z","modified":"2025-02-13T17:53:30Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T20:53:31.305109Z"}],"ghsa":[{"id":"GHSA-2mvc-557g-5638","title":"pgAdmin is affected by a multi-factor authentication bypass vulnerability","description":"pgAdmin \u003c= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’s username and password may authenticate to the application and perform sensitive actions within the application, such as managing files and executing SQL queries, regardless of the account’s MFA enrollment status.","status":"published","published":"2024-05-02T18:30:55Z","modified":"2025-02-13T19:00:20Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L","level":"medium"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:38:31.416868Z"}],"nvd":[{"id":"CVE-2024-4215","description":"pgAdmin \u003c= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’s username and password may authenticate to the application and perform sensitive actions within the application, such as managing files and executing SQL queries, regardless of the account’s MFA enrollment status.","status":"published","published":"2024-05-02T18:15:07.593Z","modified":"2026-06-17T08:01:20.723Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:09:56.122111Z"}],"osv":[{"id":"CVE-2024-4215","title":"The Multi Factor Authentication bypass vulnerability in pgAdmin 4","description":"pgAdmin \u003c= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’s username and password may authenticate to the application and perform sensitive actions within the application, such as managing files and executing SQL queries, regardless of the account’s MFA enrollment status.","status":"published","published":"2024-05-02T17:42:34.88Z","modified":"2026-10-28T02:30:59.492652021Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:44:41.963899Z"},{"id":"GHSA-2mvc-557g-5638","title":"pgAdmin is affected by a multi-factor authentication bypass vulnerability","description":"pgAdmin \u003c= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’s username and password may authenticate to the application and perform sensitive actions within the application, such as managing files and executing SQL queries, regardless of the account’s MFA enrollment status.","status":"published","published":"2024-05-02T18:30:55Z","modified":"2026-07-07T17:56:46.044020653Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L","level":"medium"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"PYSEC-2026-1768","title":"pgAdmin is affected by a multi-factor authentication bypass vulnerability","description":"pgAdmin \u003c= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’s username and password may authenticate to the application and perform sensitive actions within the application, such as managing files and executing SQL queries, regardless of the account’s MFA enrollment status.","status":"published","published":"2026-07-07T11:45:40.517081Z","modified":"2026-07-07T17:47:18.539789029Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L","level":"medium"}],"updated_at":"2026-11-02T15:52:55.06457Z"},{"id":"openSUSE-SU-2024:14052-1","title":"pgadmin4-8.8-1.1 on GA media","description":"These are all security issues fixed in the pgadmin4-8.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-17T00:00:00Z","modified":"2026-02-04T02:46:51.467862Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2024:2260-1","title":"Security update for pgadmin4","description":"This update for pgadmin4 fixes the following issues:\n\n- CVE-2024-4216: Fixed XSS in /settings/store endpoint (bsc#1223868).\n- CVE-2024-4215: Fixed multi-factor authentication bypass (bsc#1223867).\n","status":"published","published":"2024-07-02T08:03:40Z","modified":"2026-02-04T03:39:12.676337Z","updated_at":"2026-11-02T15:53:55.136363Z"}]}}