pgweb through 0.17.0 leaves POST /api/connect unguarded even when connect-backend authorization is configured. A network attacker with low privileges can submit arbitrary DB connection strings plus a custom session identifier to bypass resource-to-database mapping, enabling unauthorized access to databases and internal services. Upgrade from `