eLabFTW CVE-2026-28511

An authenticated user account with at minimum standard (low-privilege) access is required, consistent with the CVSS PR:L designation. No administrative or elevated privileges are needed. The attacker must specifically use the numeric reference/search functionality within eLabFTW - passive browsing or other application features do not trigger the disclosure. Exploitation is limited to title metadata only; attempts to access the underlying resource content are blocked by separate authorization checks that remain effective. Exploitation is limited to eLabFTW instances running versions prior to 5.4.2 accessible over a network (AV:N), with no user interaction required from a victim.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) scores 4.3 (Medium) and accurately reflects the realistic threat profile: network-reachable, low complexity, but requiring authenticated low-privilege access, with only partial confidentiality impact and no integrity or availability consequence. No EPSS score was provided in source data. KEV status is negative and no public exploit or POC has been identified. The practical risk is context-dependent: in generic research deployments with non-sensitive titles, risk is low. In healthcare or regulated research environments where resource titles encode patient identifiers, trial names, or controlled project designations, the risk materially increases - title disclosure alone may constitute a data breach under HIPAA or similar frameworks. The CVSS score does not capture this organizational context, so defenders should factor deployment environment into prioritization.

An authenticated standard user - such as a lab member with restricted team access - submits numeric reference/search queries against the eLabFTW interface. The application returns result titles from resources belonging to other teams or projects outside the user's authorization scope, potentially revealing experiment names, patient cohort identifiers, or confidential project designations. No public exploit code exists for this vulnerability, and exploitation requires no tooling beyond normal application interaction.