Incorrect authorization in eLabFTW - #VU159621
Published: November 6, 2026
Vulnerability identifier: #VU159621
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated user to spoof notifications across teams and throughout an eLabFTW instance.
The vulnerability exists due to incorrect authorization of notification targets in eLabFTW when notifications are generated through item booking. An authenticated user can exploit this issue by creating a bookable item and booking an event on it to send spoofed notifications to unauthorized targets.
Affected software
eLabFTW
Remediation
Install security update from vendor's website.
eLabFTW - update to 6.0.0