CVE-2021-43834

9.8 criticalEPSS 1.0%

Critical (9.8) in elabftw elabftw. EPSS 1.0% chance of exploitation in the next 30 days.

eLabFTW is an electronic lab notebook manager for research teams. In versions prior to 4.2.0 there is a vulnerability which allows an attacker to authenticate as an existing user, if that user was created using a single sign-on authentication option such as LDAP or SAML. It impacts instances where LDAP or SAML is used for authentication instead of the (default) local password mechanism. Users should upgrade to at least version 4.2.0.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2021-12-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

elabftw:elabftw

References

https://github.com/elabftw/elabftw/releases/tag/4.2.0
https://github.com/elabftw/elabftw/security/advisories/GHSA-98rp-gx76-33ph
https://github.com/elabftw/elabftw/releases/tag/4.2.0
https://github.com/elabftw/elabftw/security/advisories/GHSA-98rp-gx76-33ph

Check your stack JSON