Vulnerability · Published Aug 17, 2026 · Assigned by VulnCheck
CVE-2026-75103Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover
High 8.8
In plain English
A high-severity authorization bypass via user-controlled key in crawlab from crawlab-team. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.6%top 49.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account takeover and arbitrary code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| crawlab-team | crawlab | 0 – through 0.6.3 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Issue #1623 issue-tracking
- https://github.com/crawlab-team/crawlab product
- PostUserChangePassword in core/controllers/user_v2.go technical-description
- VulnCheck Advisory: Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover third-party-advisory