Incorrect authorization in eLabFTW - #VU159638
Published: November 6, 2026
Vulnerability identifier: #VU159638
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an administrator to forge eLabFTW electronic laboratory notebook records and audit logs as arbitrary users in another team.
The vulnerability exists due to incorrect cross-team authorization in /api/v2/import when processing POST requests for record imports. An administrator can submit an import request targeting a team where they are only an ordinary member and apply their administrative authority from a different team.
Affected software
eLabFTW
Remediation
Install security update from vendor's website.
eLabFTW - update to 6.0.0