Incorrect authorization in eLabFTW - #VU159631
Published: November 6, 2026
Vulnerability identifier: #VU159631
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated attacker to alter the ordering of steps in private experiments belonging to another eLabFTW team.
The vulnerability exists due to insufficient authorization enforcement in experiment step reordering when a user targets a private experiment outside their team. An authenticated attacker can reorder those steps remotely without victim interaction, making unauthorized changes to the experiment's organization.
Affected software
eLabFTW
Remediation
Install security update from vendor's website.
eLabFTW - update to 6.0.0