Incorrect authorization in eLabFTW - #VU159628
Published: November 6, 2026
Vulnerability identifier: #VU159628
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an archived team administrator to regain administrative access to a team in eLabFTW.
The vulnerability exists due to insufficient authorization enforcement in the team API when requests specify explicit team IDs for an archived administrator. An archived team administrator can use an explicit team ID in an API request to unarchive themselves and recover access despite their archived status.
Affected software
eLabFTW
Remediation
Install security update from vendor's website.
eLabFTW - update to 6.0.0