A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.
{ "urgency": "not yet assigned" }