CVE-2026-75103 PUBLISHED

Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover

Assigner: VulnCheck
Reserved: 17.08.2026 Published: 17.08.2026 Updated: 17.08.2026

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account takeover and arbitrary code execution.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.7

Product Status

Vendor crawlab-team
Product crawlab
Versions Default: unaffected
  • affected from 0 to 0.6.3 (incl.)

Credits

  • geo-chen reporter

References

Problem Types

  • Authorization Bypass Through User-Controlled Key CWE