« Volver al listado

CVE-2026-28511

Estado: AnalizadaMedia (4.3)—

eLabFTW is an open source electronic lab notebook. Prior to version 5.4.2, in certain cases, an authenticated user performing a numeric reference/search can return results that include resources the requesting user is not authorized to view. The exposed information is limited (only the title). Attempts to access the underlying protected resource content remain blocked by authorization checks. Version 5.4.2 fixes the issue.

# Affected Scope

Cross-scope visibility of titles. No confirmed bypass of content-level access controls

# Preconditions

An authenticated user account

No special privileges required beyond standard access

Leer descripción completaMostrar menos

# Impact

This may enable unauthorized disclosure of sensitive information if confidential data is included in resource titles. Examples could include project names, patient identifiers, or other regulated information embedded in titles.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Elabftw — Elabftw

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-28511",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-28511",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-02T15:54:16.040422Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "elabftw",
          "product": "elabftw",
          "versions": [
            {
              "status": "affected",
              "version": "< 5.4.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-06-01T23:16:22.080",
  "references": [
    {
      "url": "https://github.com/elabftw/elabftw/security/advisories/GHSA-wm4r-p2jg-2mj3",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "eLabFTW is an open source electronic lab notebook. Prior to version 5.4.2, in certain cases, an authenticated user performing a numeric reference/search can return results that include resources the requesting user is not authorized to view. The exposed information is limited (only the title). Attempts to access the underlying protected resource content remain blocked by authorization checks. Version 5.4.2 fixes the issue.\n\n# Affected Scope\n\nCross-scope visibility of titles.\nNo confirmed bypass of content-level access controls\n\n# Preconditions\n\nAn authenticated user account\n\nNo special privileges required beyond standard access\n\n# Impact\n\nThis may enable unauthorized disclosure of sensitive information if confidential data is included in resource titles. Examples could include project names, patient identifiers, or other regulated information embedded in titles."
    },
    {
      "lang": "es",
      "value": "eLabFTW es un cuaderno de laboratorio electrónico de código abierto. Antes de la versión 5.4.2, en ciertos casos, un usuario autenticado que realiza una referencia/búsqueda numérica puede devolver resultados que incluyen recursos que el usuario solicitante no está autorizado a ver. La información expuesta es limitada (solo el título). Los intentos de acceder al contenido subyacente del recurso protegido permanecen bloqueados por las comprobaciones de autorización. La versión 5.4.2 corrige el problema.\n\n# Alcance Afectado\n\nVisibilidad de títulos entre alcances.\nNo se ha confirmado ningún bypass de los controles de acceso a nivel de contenido\n\n# Precondiciones\n\nUna cuenta de usuario autenticado\n\nNo se requieren privilegios especiales más allá del acceso estándar\n\n# Impacto\n\nEsto puede permitir la divulgación no autorizada de información sensible si se incluyen datos confidenciales en los títulos de los recursos. Los ejemplos podrían incluir nombres de proyectos, identificadores de pacientes u otra información regulada incrustada en los títulos."
    }
  ],
  "lastModified": "2026-07-22T19:10:00.120",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:elabftw:elabftw:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "593B8947-A7C6-4FA6-8D3F-E6001CB0C8E5",
              "versionEndExcluding": "5.4.2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}