Vulnerability in eLabFTW Allows Un Authenticated Users to Gain Administrative Privileges

CVE-2024-25632

What is CVE-2024-25632?

A vulnerability in eLabFTW, an open-source electronic lab notebook, could allow a regular user to elevate their privileges to that of an administrator within a team they belong to, under certain configurations. Furthermore, for versions released after v5.0.0, there is a potential risk that an unauthorized user might gain administrative privileges over any arbitrary team without prior authentication. This poses serious security risks around user management within research labs utilizing eLabFTW. System administrators are encouraged to upgrade to the latest version, restrict local user registrations, disable features like saml_team_create, and closely control user imports to teams to enhance security measures.

References