CVE-2024-25632: Elabftw Privilege Escalation Vulnerability

CVE-2024-25632 Overview

eLabFTW is an open source electronic lab notebook used by research laboratories to manage experiments, users, and content. CVE-2024-25632 is a privilege escalation vulnerability [CWE-266] that allows a regular team member to gain administrator privileges within a team. In eLabFTW versions after v5.0.0, the flaw may also allow an initially unauthenticated user to obtain administrative privileges over an arbitrary team under reasonable configurations. The vulnerability does not affect system administrator status. Maintainers addressed the issue in version 5.1.0.

Critical Impact
Attackers can escalate from regular user (or unauthenticated in some configurations) to team administrator, gaining control over users and content in the targeted team.

Affected Products

eLabFTW versions prior to 5.1.0
eLabFTW versions after v5.0.0 (unauthenticated escalation path)
Deployments allowing local user registration, saml_team_create, or admin user imports

Discovery Timeline

2024-10-01 - CVE-2024-25632 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-25632

Vulnerability Analysis

The vulnerability resides in eLabFTW's team membership and role assignment logic. eLabFTW assigns roles per team, so a user account can hold administrator status in one team and regular user status in another. The flawed logic permits a regular team member to elevate their role to team administrator within a team they belong to.

Starting after v5.0.0, the attack surface expanded. Under supported configurations that permit self-registration, SAML-driven team creation (saml_team_create), or administrator-driven user imports, an initially unauthenticated actor can reach the same escalation path against an arbitrary team. The scope of the compromise is limited to team-level administration and does not confer system administrator (sysadmin) privileges.

Root Cause

The root cause is Incorrect Privilege Assignment [CWE-266] in the team membership handling routines. The application fails to enforce authorization checks that would prevent a user from binding themselves to an administrator role on a team where they hold only a member role. Combined with permissive registration and identity-federation options, this authorization gap becomes reachable without prior credentials on the affected instance.

Attack Vector

Exploitation occurs over the network against the eLabFTW web application. An authenticated regular user submits requests that mutate their own team role to administrator. In configurations where new accounts can self-register or be provisioned through SAML with automatic team creation, an external attacker registers or federates into the target team, then triggers the same role change. Successful exploitation yields full team-administrator control, including managing users and content assigned to that team.

No public proof-of-concept is listed in the vendor advisory. See the GitHub Security Advisory GHSA-6m7p-gh9f-5mgg for details.

Detection Methods for CVE-2024-25632

Indicators of Compromise

Unexpected changes to team administrator membership in the eLabFTW users table or audit log.
New user accounts created via local registration or SAML immediately followed by role changes.
API or web requests modifying team role assignments issued by non-administrator accounts.
Unusual saml_team_create events producing new teams with the requester as administrator.

Detection Strategies

Review eLabFTW application logs for role-change operations initiated by principals that were not previously team administrators.
Correlate authentication events with subsequent privilege-modification actions on the same session.
Compare current team administrator lists against a known-good baseline snapshot taken before upgrade or investigation.

Monitoring Recommendations

Forward eLabFTW web server and application logs to a centralized logging or SIEM platform for retention and query.
Alert on any HTTP request that changes team membership roles, especially from accounts created within the prior 24 hours.
Monitor SAML assertions that create teams and audit whether the initiating principal becomes administrator of the new team.

How to Mitigate CVE-2024-25632

Immediate Actions Required

Upgrade eLabFTW to version 5.1.0 or later on all instances.
Audit current team administrator assignments and revoke any that cannot be attributed to a legitimate change.
Review recently created user accounts and disable any that appear unauthorized.
Rotate credentials and API keys for accounts that were flagged during the audit.

Patch Information

The maintainers fixed CVE-2024-25632 in eLabFTW 5.1.0. Refer to the eLabFTW GitHub Security Advisory GHSA-6m7p-gh9f-5mgg for release details and upgrade instructions.

Workarounds

Disable local user registration on the eLabFTW instance to block unauthenticated escalation paths.
Disable the saml_team_create option so SAML logins cannot instantiate new teams with elevated roles.
Restrict administrator-driven user imports into teams unless strictly required for operations.
Limit administrator delegation to a small set of vetted accounts and review team rosters regularly.

bash

# Configuration example: disable risky options in eLabFTW config
# (Adjust via the sysadmin panel or configuration file)
local_register = 0
saml_team_create = 0
# Restrict user import capability to sysadmins only