PT-2024-21053 · Elabftw · Elabftw

Anargam · Published 2024-08-15 · Updated 2025-08-19 · CVE-2024-25633

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions eLabFTW versions 4.4.0 through 4.9.x are not explicitly mentioned, but since the vulnerability exists starting in version 4.4.0 and prior to version 5.0.0, it can be simplified to: eLabFTW versions 4.4.0 through 4.9.x is not needed, instead use: eLabFTW versions prior to 5.0.0

Description A vulnerability in eLabFTW allows regular users to create new, validated accounts in their team. If the system has anonymous access enabled, an unauthenticated user can create regular users in any team. This issue can allow a user to maintain persistence in the system, create separate accounts under different names, and produce misleading revision histories. No additional privileges are granted to the new user.

Recommendations For versions prior to 5.0.0, upgrade to version 5.0.0 to receive a patch. As a temporary workaround, consider disabling both options that allow administrators to create users. Additionally, disabling anonymous user access will stop anonymous access, including using existing access keys.

Exploit

Fix

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2024-25633

GHSA-V677-8X8P-636V

Affected Products

Elabftw

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25633.json · Exploit
• https://github.com/elabftw/elabftw/security/advisories/GHSA-v677-8x8p-636v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-25633 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25633 · Security Note
• https://t.me/cvenotify/91106 · Telegram Post
• https://t.me/cveNotify/132798 · Telegram Post
• https://twitter.com/CVEnew/status/1824154539114590364 · Twitter Post
• https://t.me/cvedetector/3282 · Telegram Post