pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary database connection strings. Attackers can bypass the resource-to-database mapping by providing a custom session identifier and connection URL to access unauthorized databases and internal services.

pgweb versions through 0.17.0 contain a missing authorization vulnerability on the POST /api/connect endpoint. When connect-backend authorization is configured, this endpoint remains unguarded, allowing attackers to supply arbitrary database connection strings. Attackers can exploit this flaw by providing custom session identifiers and connection URLs to bypass resource-to-database mappings. This enables unauthorized access to databases and internal services that should be restricted. The vulnerability effectively undermines the authorization controls intended to restrict database access. It affects all deployments of pgweb up to and including version 0.17.0 that use connect-backend authorization. The issue has been documented in the pgweb GitHub repository and flagged by VulnCheck. Organizations using pgweb with connect-backend authorization should apply mitigations or updates promptly.