Vulnerability Description
Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account takeover and arbitrary code execution.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/crawlab-team/crawlab
- https://github.com/crawlab-team/crawlab/blob/main/core/controllers/user_v2.go
- https://github.com/crawlab-team/crawlab/issues/1623
- https://www.vulncheck.com/advisories/crawlab-missing-authorization-on-password-c
- https://github.com/crawlab-team/crawlab/issues/1623
FAQ
What is CVE-2026-75103?
CVE-2026-75103 is a vulnerability with a CVSS score of 8.8 (HIGH). Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts th...
How severe is CVE-2026-75103?
CVE-2026-75103 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-75103?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.