Read the docs
TI-2024-30457 Aliases CVE-2024-45408

eLabFTW contains a direct and indirect information disclosure

Priority LOW 39CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

eLabFTW is an open source electronic lab notebook for research labs. An incorrect permission check has been found that could allow an authenticated user to access several kinds of otherwise restricted information. If anonymous access is allowed (something disabled by default), this extends to anyone. Users are advised to upgrade to at least version 5.1.0. System administrators can disable anonymous access in the System configuration panel.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00392 33rd percentileScored 2026-11-07
Fix Fixed elabftw (elabftw): 5.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
elabftwelabftw4.4.0 to before 5.1.05.1.0Patch availableCNA
  • elabftw Vendorelabftw Affected 4.4.0 to before 5.1.0 Fixed in 5.1.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:elabftw:elabftw:*:*:*:*:*:*:*:*4.4.0 to before 5.1.0Vulnerableelabftw
  • cpe:2.3:a:elabftw:elabftw:*:*:*:*:*:*:*:* Versions 4.4.0 to before 5.1.0 Vulnerable ·elabftw

Remediation

  • Fix · CNA elabftw (elabftw) Fixed in 5.1.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-45408

References

Advisory 1

  • TI-2019-09101 eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the… CVSS 3.0HIGH 8.8
  • TI-2022-13053 Privilege escalation from administrator in eLabFTW CVSS 3.1HIGH 7.2
  • TI-2021-19640 Incorrect Authentication in elabftw CVSS 3.1CRITICAL 9.8
  • TI-2021-18010 Bypass bruteforce protection on login form in elabftw CVSS 3.1HIGH 8.8
  • TI-2025-18875 Incorrect input validation could allow an authenticated user to read sensitive information CVSS 3.1HIGH 8.8
  • TI-2021-19639 Account takeover in eLabFTW CVSS 3.1HIGH 8.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences