Read the docs
TI-2021-19640 Aliases CVE-2021-43834

Incorrect Authentication in elabftw

Priority MEDIUM 44CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

eLabFTW is an electronic lab notebook manager for research teams. In versions prior to 4.2.0 there is a vulnerability which allows an attacker to authenticate as an existing user, if that user was created using a single sign-on authentication option such as LDAP or SAML. It impacts instances where LDAP or SAML is used for authentication instead of the (default) local password mechanism. Users should upgrade to at least version 4.2.0.

Why it matters now

EPSS 0.0101 63rd percentileScored 2026-11-07
Fix Fixed elabftw (elabftw): 4.2.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
elabftwelabftwbefore 4.2.04.2.0Patch availableCNA
  • elabftw Vendorelabftw Affected before 4.2.0 Fixed in 4.2.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:elabftw:elabftw:*:*:*:*:*:*:*:*before 4.2.0Vulnerableelabftw
  • cpe:2.3:a:elabftw:elabftw:*:*:*:*:*:*:*:* Versions before 4.2.0 Vulnerable ·elabftw

Remediation

  • Fix · CNA elabftw (elabftw) Fixed in 4.2.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-43834

References

Advisory 2

  • TI-2019-09101 eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the… CVSS 3.0HIGH 8.8
  • TI-2022-13053 Privilege escalation from administrator in eLabFTW CVSS 3.1HIGH 7.2
  • TI-2021-18010 Bypass bruteforce protection on login form in elabftw CVSS 3.1HIGH 8.8
  • TI-2025-18875 Incorrect input validation could allow an authenticated user to read sensitive information CVSS 3.1HIGH 8.8
  • TI-2021-19639 Account takeover in eLabFTW CVSS 3.1HIGH 8.8
  • TI-2024-30457 eLabFTW contains a direct and indirect information disclosure CVSS 3.1HIGH 7.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences