Information disclosure in eLabFTW - #VU159618
Published: November 6, 2026
Vulnerability identifier: #VU159618
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to read instance metadata from eLabFTW, including its exact version and user and experiment counts.
The vulnerability exists due to exposure of instance information through the /api/v2/info endpoint on instances permitting anonymous access. An unauthenticated remote attacker can send a GET request to this endpoint and obtain operational information useful for reconnaissance without logging in or requiring victim interaction.
Affected software
eLabFTW
Remediation
Install security update from vendor's website.
eLabFTW - update to 6.0.0