Authorization bypass through user-controlled key in eLabFTW - #VU137367
Published: July 12, 2026
Vulnerability identifier: #VU137367
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: N/A
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: elabftw
Affected software:
eLabFTW
eLabFTW
Detailed vulnerability description
The vulnerability allows a remote user to read, modify, or delete procurement requests from other teams.
The vulnerability exists due to improper access control in the procurement requests functionality when handling requests for procurement request objects. A remote privileged user can manipulate request identifiers to read, patch, or delete procurement requests from other teams to read, modify, or delete procurement requests from other teams.
Remediation
Install security update from vendor's website.