If he's not supposed to tell students the password even if they are from the correct house, how did he give Neville the whole list?

Paintings, while not exactly fully sentient, certainly aren't automatons - they are fully capable of taking action on their own initiative.

Sir Cadogan shouldn't have given Neville the passwords in advance, and that's probably why he got fired. But he was perfectly capable of doing so.

Basically, he just showed remarkably poor judgement. Given his established character, that should not come as a surprise.

If he's not supposed to tell students the password even if they are from the correct house, how did he give Neville the whole list?

Paintings, while not exactly fully sentient, certainly aren't automatons - they are fully capable of taking action on their own initiative.

Sir Cadogan shouldn't have given Neville the passwords in advance, and that may be why he got fired. But he was perfectly capable of doing so.

Basically, he just showed remarkably poor judgement. Given his established character, that should not come as a surprise.