CVE-2026-75103
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account takeover and arbitrary code execution.
Risk Assessment
The risk includes full administrator account takeover, which could lead to unauthorized system access, data theft, and remote code execution.
Recommendation
It is recommended to immediately apply vendor patches and verify authorization on the password-change endpoint.
Original NVD description (English source)
Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account takeover and arbitrary code execution.