PT-2024-35383 · Elabftw · Elabftw

Anargam · Published 2024-12-09 · Updated 2025-08-15 · CVE-2024-52586

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions eLabFTW versions 4.6.0 through 5.1.0

Description A vulnerability has been found in eLabFTW that allows an attacker to bypass the built-in multifactor authentication mechanism. This can be exploited by an attacker who can authenticate locally, allowing them to log in regardless of MFA requirements. It's noted that this does not affect MFA performed by single sign-on services.

Recommendations For versions 4.6.0 through 5.1.0, upgrade to at least version 5.1.9 to receive a fix.

Exploit

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

CWE-303

Related Identifiers

CVE-2024-52586

GHSA-PVXR-39G3-M28C

Affected Products

Elabftw

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52586.json · Exploit
• https://github.com/elabftw/elabftw/security/advisories/GHSA-pvxr-39g3-m28c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52586 · Security Note
• https://osv.dev/vulnerability/CVE-2024-52586 · Vendor Advisory
• https://t.me/cvedetector/12442 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1866261660647747704 · Twitter Post
• https://twitter.com/CVEnew/status/1866202702008729857 · Twitter Post
• https://t.me/cveNotify/132503 · Telegram Post