Read the docs
TI-2021-19639 Aliases CVE-2021-43833

Account takeover in eLabFTW

Priority MEDIUM 40CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

eLabFTW is an electronic lab notebook manager for research teams. In versions prior to 4.2.0 there is a vulnerability which allows any authenticated user to gain access to arbitrary accounts by setting a specially crafted email address. This vulnerability impacts all instances that have not set an explicit email domain name allowlist. Note that whereas neither administrators nor targeted users are notified of a change, an attacker will need to control an account. The default settings require administrators to validate newly created accounts. The problem has been patched. Users should upgrade to at least version 4.2.0. For users unable to upgrade enabling an email domain allow list (from Sysconfig panel, Security tab) will completely resolve the issue.

Why it matters now

EPSS 0.0084 58th percentileScored 2026-11-07
Fix Fixed elabftw (elabftw): 4.2.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
elabftwelabftwbefore 4.2.04.2.0Patch availableCNA
  • elabftw Vendorelabftw Affected before 4.2.0 Fixed in 4.2.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:elabftw:elabftw:*:*:*:*:*:*:*:*before 4.2.0Vulnerableelabftw
  • cpe:2.3:a:elabftw:elabftw:*:*:*:*:*:*:*:* Versions before 4.2.0 Vulnerable ·elabftw

Remediation

  • Fix · CNA elabftw (elabftw) Fixed in 4.2.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-43833

References

Advisory 2

  • TI-2019-09101 eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the… CVSS 3.0HIGH 8.8
  • TI-2022-13053 Privilege escalation from administrator in eLabFTW CVSS 3.1HIGH 7.2
  • TI-2021-19640 Incorrect Authentication in elabftw CVSS 3.1CRITICAL 9.8
  • TI-2021-18010 Bypass bruteforce protection on login form in elabftw CVSS 3.1HIGH 8.8
  • TI-2025-18875 Incorrect input validation could allow an authenticated user to read sensitive information CVSS 3.1HIGH 8.8
  • TI-2024-30457 eLabFTW contains a direct and indirect information disclosure CVSS 3.1HIGH 7.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences