Description
eLabFTW is an open source electronic lab notebook for research labs. Prior to version 5.1.15, an incorrect input validation could allow an authenticated user to read sensitive information, including login token or other content stored in the database. This could lead to privilege escalation if cookies are enabled (default setting). Users must upgrade to eLabFTW version 5.1.15 to receive a fix. No known workarounds are available.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://github.com/elabftw/elabftw/security/advisories/GHSA-qffc-rfjh-77gg
Release Notes x_refsource_misc
https://github.com/elabftw/elabftw/releases/tag/5.1.15
Scores
CVSS v3
8.3
EPSS
0.0045
EPSS Percentile
35.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-89
Status
published
Products (1)
elabftw/elabftw
< 5.1.15
Published
Feb 14, 2025
Tracked Since
Feb 18, 2026