CVE-2026-28511

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-28511
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28511.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-28511
Aliases
  • GHSA-wm4r-p2jg-2mj3
Published
2026-06-01T22:24:18.678Z
Modified
2026-07-08T08:12:46.179891642Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
elabftw has entry title leakage through autocompletion search
Details

eLabFTW is an open source electronic lab notebook. Prior to version 5.4.2, in certain cases, an authenticated user performing a numeric reference/search can return results that include resources the requesting user is not authorized to view. The exposed information is limited (only the title). Attempts to access the underlying protected resource content remain blocked by authorization checks. Version 5.4.2 fixes the issue.

Affected Scope

Cross-scope visibility of titles. No confirmed bypass of content-level access controls

Preconditions

An authenticated user account

No special privileges required beyond standard access

Impact

This may enable unauthorized disclosure of sensitive information if confidential data is included in resource titles. Examples could include project names, patient identifiers, or other regulated information embedded in titles.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28511.json"
}
References

Affected packages

Git / github.com/elabftw/elabftw

Affected ranges

Type
GIT
Repo
https://github.com/elabftw/elabftw
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
edf271bce2e7675b59158e1a603845e3fe4ba3d3
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.4.2"
        }
    ],
    "cpe": "cpe:2.3:a:elabftw:elabftw:*:*:*:*:*:*:*:*"
}

Affected versions

0.*
0.10.0
0.10.1
0.11.0
0.11.0-RC
0.11.0a
0.12.0
0.12.0-BETA
0.12.1
0.12.2
0.12.3
0.12.4
0.12.5
0.7.0
0.7.1
0.7.2
0.7.3
0.7.3.1
0.7.3.2
0.8
0.8.1
0.8.2
0.8.3
0.9.4
0.9.4.2
1.*
1.0.0
1.0.0-alpha
1.0.0-beta
1.1.0
1.1.2
1.1.2-p1
1.1.3
1.1.4
1.1.4-p1
1.1.4-p2
1.1.5
1.1.5-beta
1.1.5-p1
1.1.6
1.1.7
1.1.8
1.1.8-p1
1.1.8-p2
1.2.0
1.2.0-alpha
1.2.0-beta
1.2.0-p1
1.2.0-p2
1.2.0-p3
1.2.1
1.2.2
1.2.3
1.2.4
1.3.0
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.5.6
1.5.7
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.7.2
1.7.3
1.7.4
1.7.6
1.7.7
1.7.8
1.8.1
1.8.2
1.8.3
2.*
2.0.0
2.0.0-alpha1
2.0.0-alpha2
2.0.0-beta
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
3.*
3.0.0
3.0.0-alpha
3.0.0-beta
3.0.1
3.0.2
3.0.3
3.1.0
3.1.1
3.1.2
3.2.0
3.2.1
3.2.2
3.3.0
3.3.1
3.3.10
3.3.11
3.3.12
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.3.8
3.3.9
3.4.0
3.4.0-alpha
3.4.0-beta
3.4.1
3.4.10
3.4.2
3.4.3
3.4.4
3.4.5
3.4.6
3.4.7
3.4.8
3.4.9
3.5.0
3.5.0-beta
3.5.0-rc
3.5.1
3.5.2
3.5.3
3.5.4
3.6.0
3.6.0-alpha
3.6.0-beta
3.6.0-rc
3.6.1
3.6.2
3.6.3
3.6.4
4.*
4.0.0
4.0.0-alpha
4.0.0-alpha2
4.0.0-beta
4.0.0-beta2
4.0.0-beta3
4.0.0-beta4
4.0.0-beta5
4.0.0-beta6
4.0.1
4.0.10
4.0.11
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.1.0
4.1.0-BETA
4.1.0-BETA2
4.1.0-BETA3
4.1.0-BETA4
4.1.0-BETA5
4.1.0-BETA6
4.2.0
4.2.0-BETA
4.2.1
4.2.2
4.3.0
4.3.0-alpha
4.3.0-beta
4.3.0-beta2
4.3.0-beta3
4.3.0-beta4
4.3.0-beta5
4.3.1
4.3.2
4.3.3
4.4.0
4.4.0-alpha
4.4.0-alpha2
4.4.0-alpha3
4.4.0-alpha4
4.4.0-alpha5
4.4.0-beta
4.4.0-beta2
4.4.0-beta3
4.4.0-beta4
4.4.0-beta5
4.4.0-beta6
4.4.0-beta7
4.4.1
4.4.2
4.4.3
4.5.0
4.5.0-beta
4.5.0-beta2
4.5.0-beta3
4.5.1
4.5.12
4.5.2
4.5.3
4.5.4
4.6.0
4.6.0-alpha
4.6.0-alpha2
4.6.0-alpha3
4.6.0-alpha4
4.6.0-beta
4.6.0-beta2
4.6.1
4.7.0
4.8.0
4.8.0-alpha
4.8.0-beta
4.8.1
4.8.2
4.8.3
4.9.0
4.9.0-alpha
4.9.0-beta
4.9.0-beta2
5.*
5.0.0
5.0.0-alpha
5.0.0-alpha2
5.0.0-alpha3
5.0.0-alpha4
5.0.0-beta
5.0.0-beta2
5.0.0-beta3
5.1.0
5.1.0-alpha
5.1.0-alpha2
5.1.0-alpha3
5.1.0-alpha4
5.1.0-beta
5.1.0-beta2
5.1.0-beta3
5.1.0-beta4
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.1.6
5.1.7
5.2.0
5.2.0-alpha
5.2.0-alpha2
5.2.0-alpha3
5.2.0-alpha4
5.2.0-alpha5
5.2.0-beta
5.2.0-beta2
5.2.1
5.2.2
5.2.3
5.3.0
5.3.0-alpha
5.3.0-alpha2
5.3.0-alpha3
5.3.0-alpha4
5.3.0-alpha5
5.3.0-alpha6
5.3.0-beta
5.3.0-beta2
5.3.0-beta3
5.3.0-rc
5.3.1
5.3.2
5.4.0
5.4.0-alpha
5.4.0-alpha2
5.4.0-alpha3
5.4.0-beta
5.4.0-beta2
5.4.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28511.json"