eLabFTW Incorrect Input Validation Vulnerability Leading to Sensitive Information Disclosure and Potential Privilege Escalation

A vulnerability in eLabFTW, an open-source electronic lab notebook, prior to version 5.1.15, allows authenticated users to read sensitive information from the database, including login tokens. This incorrect input validation could lead to privilege escalation, especially if cookies are enabled, which is the default setting. Users are advised to upgrade to eLabFTW version 5.1.15, the first version containing the patch. No workarounds are available.

Impact

Exploitation of this vulnerability could result in unauthorized access to sensitive information, such as login tokens, and could allow for privilege escalation within the application.

Remediation

Users must upgrade to eLabFTW version 5.1.15 to address this vulnerability. Instructions for upgrading can be found in the eLabFTW GitHub repository.