Missing Authorization in eLabFTW - #VU165872
Published: November 11, 2026
Vulnerability identifier: #VU165872
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to take ownership of shared entities and move them across teams without authorization.
The vulnerability exists due to missing authorization in eLabFTW entity ownership and team management when processing changes from shared entity editors. A remote user can use ordinary write access to transfer an entity's ownership to themselves and move it to their team, permanently removing it from its owning team.
Affected software
eLabFTW
Remediation
Install security update from vendor's website.
eLabFTW - update to 5.6.13