CVE-2026-75103: Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover
Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account takeover and arbitrary code execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-75103?
The severity of CVE-2026-75103 is rated high with a score of 8.8.
How do I fix CVE-2026-75103?
To fix CVE-2026-75103, implement proper authorization checks on the password-change endpoint.
What vulnerabilities does CVE-2026-75103 introduce?
CVE-2026-75103 introduces the risk of account takeover due to the lack of user ownership verification.
How does CVE-2026-75103 allow unauthorized access?
CVE-2026-75103 allows unauthorized access by enabling any authenticated user to reset passwords without verifying their role.
What system is affected by CVE-2026-75103?
CVE-2026-75103 affects the Crawlab software system.