Insecure direct object reference (IDOR)
Published: October 20, 2026
SECURITY IDENTIFIERS
- GHSA: GHSA-5287-hmjh-qmqq
- Vendor Advisory: https://github.com/ankane/pghero/security/advisories/GHSA-5287-hmjh-qmqq
GEM
SEVERITY
CVSS v3.x: 6.5 (Medium)
PATCHED VERSIONS
>= 4.1.0
DESCRIPTION
An authenticated user can kill connections and certain Postgres backend processes for other databases on the same instance if the PgHero database user has privileges to do so.