Read the docs
TI-2021-12366 Aliases CVE-2021-32698

Blind Server-Side Request Forgery (SSRF) in eLabFTW

Priority LOW 32CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

eLabFTW is an open source electronic lab notebook for research labs. This vulnerability allows an attacker to make GET requests on behalf of the server. It is "blind" because the attacker cannot see the result of the request. Issue has been patched in eLabFTW 4.0.0.

Why it matters now

EPSS 0.00936 61st percentileScored 2026-11-07
Fix Fixed elabftw (elabftw): 4.0.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
elabftwelabftwbefore 4.0.04.0.0Patch availableCNA
  • elabftw Vendorelabftw Affected before 4.0.0 Fixed in 4.0.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:elabftw:elabftw:*:*:*:*:*:*:*:*before 4.0.0Vulnerableelabftw
  • cpe:2.3:a:elabftw:elabftw:*:*:*:*:*:*:*:* Versions before 4.0.0 Vulnerable ·elabftw

Remediation

  • Fix · CNA elabftw (elabftw) Fixed in 4.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32698

References

Patch 2

  • TI-2019-09101 eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the… CVSS 3.0HIGH 8.8
  • TI-2022-13053 Privilege escalation from administrator in eLabFTW CVSS 3.1HIGH 7.2
  • TI-2021-19640 Incorrect Authentication in elabftw CVSS 3.1CRITICAL 9.8
  • TI-2021-18010 Bypass bruteforce protection on login form in elabftw CVSS 3.1HIGH 8.8
  • TI-2025-18875 Incorrect input validation could allow an authenticated user to read sensitive information CVSS 3.1HIGH 8.8
  • TI-2021-19639 Account takeover in eLabFTW CVSS 3.1HIGH 8.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences