CVE-2021-43834

eLabFTW is an electronic lab notebook manager for research teams. In versions prior to 4.2.0 there is a vulnerability which allows an attacker to authenticate as an existing user, if that user was created using a single sign-on authentication option such as LDAP or SAML. It impacts instances where LDAP or SAML is used for authentication instead of the (default) local password mechanism. Users should upgrade to at least version 4.2.0.

• CWE-287

• https://github.com/elabftw/elabftw/releases/tag/4.2.0Release Notes, Third Party Advisory
• https://github.com/elabftw/elabftw/security/advisories/GHSA-98rp-gx76-33phThird Party Advisory
• https://github.com/elabftw/elabftw/releases/tag/4.2.0Release Notes, Third Party Advisory
• https://github.com/elabftw/elabftw/security/advisories/GHSA-98rp-gx76-33phThird Party Advisory

Published

Dec 16, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43829PatrOwl is a free and open-source solution for orchestrating…8.8
• CVE-2021-4383The WP Quick FrontEnd Editor plugin for WordPress is vulnera…4.3
• CVE-2021-43830OpenProject is a web-based project management software. Open…8.8
• CVE-2021-43831Gradio is an open source framework for building interactive …7.7
• CVE-2021-43832Spinnaker is an open source, multi-cloud continuous delivery…9.8
• CVE-2021-43833eLabFTW is an electronic lab notebook manager for research t…8.8
• CVE-2021-43835Sulu is an open-source PHP content management system based o…7.2
• CVE-2021-43836Sulu is an open-source PHP content management system based o…8.8
• CVE-2021-43837vault-cli is a configurable command-line interface tool (and…9.1
• CVE-2021-43838jsx-slack is a library for building JSON objects for Slack B…7.5
• CVE-2021-43839Cronos is a commercial implementation of a blockchain. In Cr…7.5
• CVE-2021-4384The WordPress Photo Gallery – Image Gallery plugin for WordP…4.3