The vulnerability is an information disclosure flaw caused by an autocompletion search feature that reveals the titles of protected resources to authenticated users who do not have permission to view the full content. Only the title is exposed, but if a title contains sensitive or regulated data—such as project names or patient identifiers—the confidentiality of that information is at risk. The weakness is identified as CWE‑200.

The flaw affects installations of eLabFTW, an open‑source electronic lab notebook, in versions older than 5.4.2. Users of any standard authenticated account are subject to the impact; no special privileges are required.

The CVSS score of 4.3 indicates a moderate severity, while the EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting a lower exploitation likelihood. However, the attack vector is authenticated, meaning any logged‑in user could perform a numeric reference/search that triggers the autocompletion and leaks titles. Because the underlying content remains protected by authorization checks, the impact is limited to disclosure of titles only, but the presence of sensitive data in titles could still be a serious privacy concern.