SB2026110651 - Multiple vulnerabilities in eLabFTW
Published: November 6, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 25 vulnerabilities.
1) Insufficient Session Expiration (CVE-ID: N/A)
CWE-ID: CWE-613 - Insufficient Session Expiration
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated remote attacker to bypass eLabFTW's account lockout protection against brute-force login attempts.
The vulnerability exists due to ineffective enforcement of account lockout in eLabFTW's authentication protection when repeated login attempts occur. An unauthenticated remote attacker can continue making brute-force login attempts despite the protection intended to stop them, without requiring victim interaction.
2) Path traversal (CVE-ID: N/A)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a low-privileged authenticated user to poison another user's export artifact in eLabFTW by writing attacker-controlled content.
The vulnerability exists due to improper restriction of ZIP entry paths during ELN import, allowing ../ traversal outside the intended per-import extraction directory. A low-privileged authenticated user can upload a crafted ELN archive to write attacker-controlled files into the shared exports storage directory.
3) Incorrect authorization (CVE-ID: N/A)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an administrator to forge eLabFTW electronic laboratory notebook records and audit logs as arbitrary users in another team.
The vulnerability exists due to incorrect cross-team authorization in /api/v2/import when processing POST requests for record imports. An administrator can submit an import request targeting a team where they are only an ordinary member and apply their administrative authority from a different team.
4) Improper Authentication (CVE-ID: N/A)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote authenticated attacker with low privileges to take over another user's eLabFTW account.
The vulnerability exists due to improper email comparison during SAML identity provider login, allowing email collation to bypass authentication checks. A remote authenticated attacker with low privileges can exploit this comparison when SAML login is enabled to access the victim's account without victim interaction.
5) Insufficient Session Expiration (CVE-ID: N/A)
CWE-ID: CWE-613 - Insufficient Session Expiration
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a low-privileged attacker to retain API read and write access to eLabFTW after an administrator expires or suspends their account.
The vulnerability exists due to missing account lifecycle checks during API-key authentication and failure to revoke existing keys upon expiration or suspension. A low-privileged attacker can use a previously issued API key to continue accessing and modifying data despite being unable to log in through the web interface.
6) Improper access control (CVE-ID: N/A)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated remote attacker to read inventory data, modify global inventory storage units, and corrupt private container location paths in eLabFTW.
The vulnerability exists due to insufficient access controls on an API endpoint when the non-default anonymous access feature is enabled. An unauthenticated remote attacker can use an anonymous session to submit API requests that read and modify inventory records.
7) Missing Authorization (CVE-ID: N/A)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an authenticated remote attacker to retrieve active procurement request information belonging to another team in eLabFTW.
The vulnerability exists due to missing team-level authorization in procurement request retrieval when the same entity identifier is queried. An authenticated remote attacker can query that identifier while belonging to a different team and obtain the other team's active procurement request without victim interaction.
8) Authorization bypass through user-controlled key (CVE-ID: N/A)
CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an authenticated attacker with low privileges to read another user's pending request actions in eLabFTW.
The vulnerability exists due to an authorization bypass through a user-controlled key when accessing pending request actions belonging to a different user. An authenticated attacker with low privileges can target another user's pending request actions and obtain their contents without requiring that user's interaction.
9) Incorrect authorization (CVE-ID: N/A)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated remote attacker to read private storage-unit data in eLabFTW when the non-default Anonymous access feature is enabled.
The vulnerability exists due to incorrect authorization in the storage-units API endpoint when handling requests from anonymous visitors. An unauthenticated remote attacker can request this endpoint without credentials and obtain private data that should not be accessible anonymously.
10) Incorrect authorization (CVE-ID: N/A)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an authenticated attacker to alter the ordering of steps in private experiments belonging to another eLabFTW team.
The vulnerability exists due to insufficient authorization enforcement in experiment step reordering when a user targets a private experiment outside their team. An authenticated attacker can reorder those steps remotely without victim interaction, making unauthorized changes to the experiment's organization.
11) Incorrect authorization (CVE-ID: N/A)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated remote attacker to read private data from the compounds and chemical registry in eLabFTW.
The vulnerability exists due to incorrect authorization in the registry API endpoint when the non-default Anonymous access feature is enabled on the installation. An unauthenticated remote attacker can request registry data through this endpoint without credentials or interaction from another user.
12) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N]
The vulnerability allows a low-privileged remote attacker to make the eLabFTW server connect to an arbitrary host and port and send an attacker-controlled request.
The vulnerability exists due to server-side processing of attacker-supplied gopher:// URLs in imported changelog content during PDF export. A low-privileged remote attacker can import a crafted ELN file and export it as a PDF with the changelog included to trigger blind server-side request forgery.
13) Incorrect authorization (CVE-ID: N/A)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an archived team administrator to regain administrative access to a team in eLabFTW.
The vulnerability exists due to insufficient authorization enforcement in the team API when requests specify explicit team IDs for an archived administrator. An archived team administrator can use an explicit team ID in an API request to unarchive themselves and recover access despite their archived status.
14) Missing Authorization (CVE-ID: N/A)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a highly privileged user to join a visible team in eLabFTW without approval from a team administrator.
The vulnerability exists due to missing authorization in the team joining workflow when a user with a validated account has no active team. A highly privileged user can request membership in another visible team and become a member without administrator validation.
15) Incorrect authorization (CVE-ID: N/A)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated remote attacker to read the body and metadata of a deleted eLabFTW experiment.
The vulnerability exists due to access-key sharing continuing to authorize access to a previously shared experiment after it has been soft-deleted. An unauthenticated remote attacker can use the experiment's old, correct access_key in its sharing link to retrieve the deleted experiment page without logging in.
16) Incorrect authorization (CVE-ID: N/A)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated attacker to download attached files from deleted entities in eLabFTW, exposing their contents.
The vulnerability exists due to incorrect authorization in access-key-based attachment downloads, which remain available after the parent entity is deleted. An unauthenticated attacker can use a valid access key for an affected attachment to retrieve the complete file without logging in, despite deletion of its parent.
17) Insufficient Session Expiration (CVE-ID: N/A)
CWE-ID: CWE-613 - Insufficient Session Expiration
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a low-privileged remote attacker to retain authenticated access to eLabFTW after their account expires or is archived.
The vulnerability exists due to insufficient expiration of active PHP sessions when the associated account expires or is archived. A low-privileged remote attacker can continue using a session established before that account status change to remain logged in.
18) Cross-site scripting (CVE-ID: N/A)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows an authenticated user to execute JavaScript in another user's browser through a malicious spreadsheet attachment.
The vulnerability exists due to stored formula injection in eLabFTW's Spreadsheet editor when it processes a crafted XLSX attachment opened by another user. An authenticated user can upload the crafted attachment and cause script execution when a victim opens it with the Spreadsheet editor.
19) Missing Authorization (CVE-ID: N/A)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated remote attacker to read private procurement and team metadata in eLabFTW, including metadata belonging to invisible teams.
The vulnerability exists due to missing authorization checks on an API endpoint when the non-default anonymous access feature is enabled. An unauthenticated remote attacker can request data through this endpoint and obtain private information without authentication or victim interaction.
20) Incorrect authorization (CVE-ID: N/A)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an authenticated user to spoof notifications across teams and throughout an eLabFTW instance.
The vulnerability exists due to incorrect authorization of notification targets in eLabFTW when notifications are generated through item booking. An authenticated user can exploit this issue by creating a bookable item and booking an event on it to send spoofed notifications to unauthorized targets.
21) Missing Authorization (CVE-ID: N/A)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated remote attacker to read all procurement requests in eLabFTW, including confidential purchase order details.
The vulnerability exists due to missing authorization in an API endpoint when the non-default Anonymous access feature is enabled. An unauthenticated remote attacker can query the endpoint without logging in and obtain private procurement data that should not be publicly accessible.
22) Missing Authorization (CVE-ID: N/A)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a low-privileged attacker to enumerate private team groups, member lists, and individual user profiles in eLabFTW.
The vulnerability exists due to missing authorization checks in an API endpoint when the non-default Anonymous access feature is enabled. A low-privileged attacker can query the endpoint through anonymous access to read private data without victim interaction.
23) Information disclosure (CVE-ID: N/A)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated remote attacker to read instance metadata from eLabFTW, including its exact version and user and experiment counts.
The vulnerability exists due to exposure of instance information through the /api/v2/info endpoint on instances permitting anonymous access. An unauthenticated remote attacker can send a GET request to this endpoint and obtain operational information useful for reconnaissance without logging in or requiring victim interaction.
24) Improper access control (CVE-ID: N/A)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated remote attacker to read private team tag and RoR data in eLabFTW.
The vulnerability exists due to missing access control on an API endpoint when the non-default anonymous access feature is enabled. An unauthenticated remote attacker can send requests to the affected endpoint and obtain private data without credentials or victim interaction.
25) Improper access control (CVE-ID: N/A)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated remote attacker to read private experiment and resource content in eLabFTW.
The vulnerability exists due to insufficient access restrictions on an API endpoint when the non-default Anonymous access feature is enabled. An unauthenticated remote attacker can request private content through the API without signing in or requiring any interaction from another user.
Remediation
Install update from vendor's website.
References
- https://github.com/elabftw/elabftw/security/advisories/GHSA-mw4j-52cp-gjj2
- https://github.com/elabftw/elabftw/security/advisories/GHSA-vcvr-chhm-hh35
- https://github.com/elabftw/elabftw/security/advisories/GHSA-6mqq-wx77-qxh5
- https://github.com/elabftw/elabftw/security/advisories/GHSA-5j8x-455m-39qg
- https://github.com/elabftw/elabftw/security/advisories/GHSA-5pqf-wqfm-x7x8
- https://github.com/elabftw/elabftw/security/advisories/GHSA-9cwx-5qp6-8mgx
- https://github.com/elabftw/elabftw/security/advisories/GHSA-xqv3-cr6w-5m5w
- https://github.com/elabftw/elabftw/security/advisories/GHSA-4x5j-ghv6-wq2w
- https://github.com/elabftw/elabftw/security/advisories/GHSA-f593-wgq4-8w92
- https://github.com/elabftw/elabftw/security/advisories/GHSA-3m3g-9jgr-chxq
- https://github.com/elabftw/elabftw/security/advisories/GHSA-m68v-7xmw-p9rm
- https://github.com/elabftw/elabftw/security/advisories/GHSA-57qm-qvh7-wcm4
- https://github.com/elabftw/elabftw/security/advisories/GHSA-5f74-mf52-fxw8
- https://github.com/elabftw/elabftw/security/advisories/GHSA-9j45-8vqg-jfcq
- https://github.com/elabftw/elabftw/security/advisories/GHSA-4qh7-g4cx-j4x5
- https://github.com/elabftw/elabftw/security/advisories/GHSA-5cfw-m7pp-5q6p
- https://github.com/elabftw/elabftw/security/advisories/GHSA-55pw-cvfr-vx5x
- https://github.com/elabftw/elabftw/security/advisories/ghsa-qw4p-9pqm-vvj2
- https://github.com/elabftw/elabftw/security/advisories/GHSA-mhx8-qxgg-qj9r
- https://github.com/elabftw/elabftw/security/advisories/GHSA-7347-9rmr-38hg
- https://github.com/elabftw/elabftw/security/advisories/GHSA-cc36-2mmj-5546
- https://github.com/elabftw/elabftw/security/advisories/GHSA-vff7-4768-9r39
- https://github.com/elabftw/elabftw/security/advisories/GHSA-r5jw-6xr4-9m38
- https://github.com/elabftw/elabftw/security/advisories/GHSA-34jr-78h4-7rq8
- https://github.com/elabftw/elabftw/security/advisories/GHSA-8m77-wr72-fpcj
- https://github.com/elabftw/elabftw/security/advisories/GHSA-prph-6cvm-cg3w