CVE-2022-31007mediumCWE-1287CWE-842

CVE-2022-31007: medium-severity vulnerability in elabftw

Privilege escalation from administrator in eLabFTW

Published · Updated

Follow this CVE+ Monitor elabftw

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

18Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.9epss 27%
In short

An administrator in a team within eLabFTW could incorrectly elevate themselves to system administrator level, gaining control over the entire application instead of just their team. This matters because it breaks the intended separation of permissions and allows one compromised admin account to take over the whole system.

Technical detail

An authenticated user with team administrator privileges in eLabFTW versions prior to 4.3.0 can exploit insufficient privilege validation (CWE-1287, CWE-842) to assign themselves or create system administrator accounts with global application access. The vulnerability requires prior admin access within a team context and was patched in version 4.3.0.

Summary generated and translated by AI from the official description.
eLabFTW is an electronic lab notebook manager for research teams. Prior to version 4.3.0, a vulnerability allows an authenticated user with an administrator role in a team to assign itself system administrator privileges within the application, or create a new system administrator account. The issue has been corrected in eLabFTW version 4.3.0. In the context of eLabFTW, an administrator is a user account with certain privileges to manage users and content in their assigned team/teams. A system administrator account can manage all accounts, teams and edit system-wide settings within the application. The impact is not deemed as high, as it requires the attacker to have access to an administrator account. Regular user accounts cannot exploit this to gain admin rights. A workaround for one if the issues is removing the ability of administrators to create accounts.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Affected products
elabftw · elabftw
Related CVEs — elabftw

In the same product, most dangerous first.

CVE-2021-41171MEDIUMBypass bruteforce protection on login form in elabftwEPSS 1.9%CVE-2021-43834CRITICALIncorrect Authentication in elabftwEPSS 1.0%CVE-2021-32698MEDIUMBlind Server-Side Request Forgery (SSRF) in eLabFTWEPSS 0.9%CVE-2021-43833HIGHAccount takeover in eLabFTWEPSS 0.8%CVE-2022-31178MEDIUMImproper Authorization in eLabFTWEPSS 0.5%CVE-2025-25206HIGHIncorrect input validation could allow an authenticated user to read sensitive informationEPSS 0.5%