CVE-2026-75103
Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover
- State
- Published
- Severity
- 8.7 High
- Published
- Aug 17, 2026
- Updated
- Sep 24, 2026
- Reserved
- Aug 17, 2026
Description
Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account takeover and arbitrary code execution.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
crawlabcrawlab-team |
|
References
- GitHub Issue #1623issue-tracking
- https://github.com/crawlab-team/crawlabproduct
- PostUserChangePassword in core/controllers/user_v2.gotechnical-description
- VulnCheck Advisory: Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeoverthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.