{"id":"CVE-2026-75103","state":"PUBLISHED","title":"Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover","description":"Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account takeover and arbitrary code execution.","publishedAt":"2026-08-17T20:36:00.054Z","updatedAt":"2026-09-24T14:19:16.397Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["crawlab-team crawlab"],"affected":[{"vendor":"crawlab-team","product":"crawlab","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"0.6.3","versionType":"custom"}],"repo":"https://github.com/crawlab-team/crawlab"}],"references":["https://github.com/crawlab-team/crawlab/issues/1623","https://github.com/crawlab-team/crawlab","https://github.com/crawlab-team/crawlab/blob/main/core/controllers/user_v2.go","https://www.vulncheck.com/advisories/crawlab-missing-authorization-on-password-change-endpoint-allows-account-takeover"],"weaknesses":["CWE-639"],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/75xxx/CVE-2026-75103.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-75103","state":"PUBLISHED","datePublished":"2026-08-17T20:36:00.054Z","dateUpdated":"2026-09-24T14:19:16.397Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-08-17T17:28:41.676Z"},"containers":{"cna":{"title":"Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover","descriptions":[{"lang":"en","value":"Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account takeover and arbitrary code execution."}],"affected":[{"vendor":"crawlab-team","product":"crawlab","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"0.6.3","versionType":"custom"}],"repo":"https://github.com/crawlab-team/crawlab"}],"references":[{"url":"https://github.com/crawlab-team/crawlab/issues/1623","tags":["issue-tracking"],"name":"GitHub Issue #1623"},{"url":"https://github.com/crawlab-team/crawlab","tags":["product"]},{"url":"https://github.com/crawlab-team/crawlab/blob/main/core/controllers/user_v2.go","tags":["technical-description"],"name":"PostUserChangePassword in core/controllers/user_v2.go"},{"url":"https://www.vulncheck.com/advisories/crawlab-missing-authorization-on-password-change-endpoint-allows-account-takeover","name":"VulnCheck Advisory: Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-639","lang":"en","description":"Authorization Bypass Through User-Controlled Key","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-09-24T14:19:16.397Z"},"datePublic":"2026-06-13T00:00:00.000Z","credits":[{"lang":"en","value":"George Chen","type":"finder"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/crawlab-team/crawlab/issues/1623","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-18T15:32:23.979290Z","id":"CVE-2026-75103","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-18T15:32:54.562Z"}}]}}}