Missing Authorization in eLabFTW - #VU137357
Published: July 12, 2026
Vulnerability identifier: #VU137357
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: N/A
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: elabftw
Affected software:
eLabFTW
eLabFTW
Detailed vulnerability description
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to missing authorization in the generic entity update path when handling generic PATCH requests that include raw userid and team fields through EntityParams. A remote user can send a specially crafted PATCH request to disclose sensitive information.
The issue affects ownership transfer between teams through the generic action:update path and bypasses the checks implemented in updateOwnership().
Remediation
Install security update from vendor's website.