CVE-2026-28511

eLabFTW is an open source electronic lab notebook. Prior to version 5.4.2, in certain cases, an authenticated user performing a numeric reference/search can return results that include resources the requesting user is not authorized to view. The exposed information is limited (only the title). Attempts to access the underlying protected resource content remain blocked by authorization checks. Version 5.4.2 fixes the issue. # Affected Scope Cross-scope visibility of titles. No confirmed bypass of content-level access controls # Preconditions An authenticated user account No special privileges required beyond standard access # Impact This may enable unauthorized disclosure of sensitive information if confidential data is included in resource titles. Examples could include project names, patient identifiers, or other regulated information embedded in titles.

• CWE-200

• https://github.com/elabftw/elabftw/security/advisories/GHSA-wm4r-p2jg-2mj3Vendor Advisory

Published

Jun 1, 2026

Last Modified

Jul 22, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28506Outline is a service that allows for collaborative documenta…4.3
• CVE-2026-28507Idno is a social publishing platform. Prior to version 1.6.4…7.2
• CVE-2026-28508Idno is a social publishing platform. Prior to version 1.6.4…8.6
• CVE-2026-28509LangBot is a global IM bot platform designed for LLMs. Prior…5.4
• CVE-2026-2851A vulnerability was determined in yeqifu warehouse up to aaf…5.3
• CVE-2026-28510eLabFTW is an open source electronic lab notebook. In elabft…5.9
• CVE-2026-28512Pocket ID is an OIDC provider that allows users to authentic…6.1
• CVE-2026-28513Pocket ID is an OIDC provider that allows users to authentic…7.1
• CVE-2026-28514Rocket.Chat is an open-source, secure, fully customizable co…9.8
• CVE-2026-28515openDCIM version 23.04, through commit 4467e9c4, contains a …8.8
• CVE-2026-28516openDCIM version 23.04, through commit 4467e9c4, contains a …8.8
• CVE-2026-28517openDCIM version 23.04, through commit 4467e9c4, contains an…9.8