CVE-2024-52586 eLabFTW MFA bypass
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2024-52586?
CVE-2024-52586 is a medium-severity vulnerability in elabftw, published on 9 Dec 2024.
Official description
eLabFTW is an open source electronic lab notebook for research labs. A vulnerability has been found starting in version 4.6.0 and prior to version 5.1.0 that allows an attacker to bypass eLabFTW's built-in multifactor authentication mechanism. An attacker who can authenticate locally (by knowing or guessing the password of a user) can thus log in regardless of MFA requirements. This does not affect MFA that are performed by single sign-on services. Users are advised to upgrade to at least version 5.1.9 to receive a fix.
Which versions are affected by CVE-2024-52586?
It affects 1 product.
Products include Elabftw Elabftw.
How do I fix CVE-2024-52586?
No fix has been published for CVE-2024-52586 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-52586 being exploited?
There is no known exploitation of CVE-2024-52586 in the wild and no public exploit code.
Other vulnerabilities in elabftw
- CVE-2021-43834 Incorrect Authentication in elabftw
- CVE-2024-28100 Stored Cross-site Scripting leading to arbitrary actions taken on behalf of users in elabftw
- CVE-2019-12185 File upload in n/a
- CVE-2024-25632 Unauthorised granting of administrator privileges over arbitrary teams under certain circumstances
- CVE-2025-25206 Incorrect input validation could allow an authenticated user to read sensitive information
Sources
Also known as GHSA-pvxr-39g3-m28c.