CVE-2026-75103CWE-639

CVE-2026-75103

High · published August 18, 2026

CVSS v3.1

8.8

EPSS

Percentile

36.1

In the wild

Unconfirmed

What it is

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account takeover and arbitrary code execution.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00429 · 36.1th percentile
Weakness: CWE-639 · Authorization Bypass Through User-Controlled Key
Published: 2026-08-18T01:16Z

References (5)

https://github.com/crawlab-team/crawlab · [email protected]https://github.com/crawlab-team/crawlab/blob/main/core/controllers/user_v2.go · [email protected]https://github.com/crawlab-team/crawlab/issues/1623 · [email protected]https://www.vulncheck.com/advisories/crawlab-missing-authorization-on-password-change-endpoint-allows-account-takeover · [email protected]https://github.com/crawlab-team/crawlab/issues/1623 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

17 AUG 20:36Z
Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover
cvelistv5