Insufficient Session Expiration in eLabFTW - #VU159636
Published: November 6, 2026
Vulnerability identifier: #VU159636
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-613
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged attacker to retain API read and write access to eLabFTW after an administrator expires or suspends their account.
The vulnerability exists due to missing account lifecycle checks during API-key authentication and failure to revoke existing keys upon expiration or suspension. A low-privileged attacker can use a previously issued API key to continue accessing and modifying data despite being unable to log in through the web interface.
Affected software
eLabFTW
Remediation
Install security update from vendor's website.
eLabFTW - update to 6.0.0