Insufficient Session Expiration in eLabFTW - #VU159624
Published: November 6, 2026
Vulnerability identifier: #VU159624
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-613
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged remote attacker to retain authenticated access to eLabFTW after their account expires or is archived.
The vulnerability exists due to insufficient expiration of active PHP sessions when the associated account expires or is archived. A low-privileged remote attacker can continue using a session established before that account status change to remain logged in.
Affected software
eLabFTW
Remediation
Install security update from vendor's website.
eLabFTW - update to 6.0.0