PT-2024-21052 · Elabftw · Elabftw

Anargam · Published 2024-10-01 · Updated 2025-08-15 · CVE-2024-25632

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions eLabFTW versions prior to 5.1.0

Description The issue allows a regular user to become an administrator of a team where they are a member, under a reasonable configuration. In versions subsequent to v5.0.0, it may also allow an initially unauthenticated user to gain administrative privileges over an arbitrary team. This does not affect system administrator status.

Recommendations For versions prior to 5.1.0, users should upgrade to version 5.1.0. System administrators are advised to turn off local user registration, saml team create, and not allow administrators to import users into teams, unless strictly required.

Exploit

Fix

Incorrect Privilege Assignment

Weakness Enumeration

CWE-842

CWE-266

Related Identifiers

CVE-2024-25632

GHSA-6M7P-GH9F-5MGG

Affected Products

Elabftw

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25632.json · Exploit
• https://github.com/elabftw/elabftw/security/advisories/GHSA-6m7p-gh9f-5mgg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-25632 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25632 · Security Note
• https://twitter.com/cracbot/status/1842082350039179520 · Twitter Post
• https://t.me/cvedetector/6758 · Telegram Post
• https://t.me/cveNotify/132452 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1841231744063660184 · Twitter Post
• https://t.me/cvenotify/96711 · Telegram Post
• https://twitter.com/CVEnew/status/1841128742728442220 · Twitter Post
• https://twitter.com/CveFindCom/status/1841131234291745165 · Twitter Post
• https://t.me/latest_high_impact_cve/1245 · Telegram Post