CVE-2026-75103

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account takeover and arbitrary code execution.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/crawlab-team/crawlab
https://github.com/crawlab-team/crawlab/blob/main/core/controllers/user_v2.go
https://github.com/crawlab-team/crawlab/issues/1623
https://www.vulncheck.com/advisories/crawlab-missing-authorization-on-password-change-endpoint-allows-account-takeover
https://github.com/crawlab-team/crawlab/issues/1623

Configurations

No configuration.

History

23 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) Crawlab no verifica la propiedad del usuario o el rol administrativo en el endpoint de cambio de contraseña, permitiendo que cualquier usuario autenticado restablezca la contraseña de cualquier cuenta. Los atacantes pueden enumerar cuentas de usuario a través del endpoint de listado de usuarios y cambiar las credenciales de administrador para lograr una toma de control total de la cuenta y ejecución de código arbitrario.

Information

Published : 2026-08-17 21:16

Updated : 2026-10-23 16:10

NVD link : CVE-2026-75103

Mitre link : CVE-2026-75103

CVE.ORG link : CVE-2026-75103

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-75103", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75103", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-18T15:32:23.979290Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/crawlab-team/crawlab", "vendor": "crawlab-team", "product": "crawlab", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.6.3"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-17T21:16:49.200", "references": [{"url": "https://github.com/crawlab-team/crawlab", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/crawlab-team/crawlab/blob/main/core/controllers/user_v2.go", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/crawlab-team/crawlab/issues/1623", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/crawlab-missing-authorization-on-password-change-endpoint-allows-account-takeover", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/crawlab-team/crawlab/issues/1623", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account takeover and arbitrary code execution."}, {"lang": "es", "value": "Crawlab no verifica la propiedad del usuario o el rol administrativo en el endpoint de cambio de contrase\u00f1a, permitiendo que cualquier usuario autenticado restablezca la contrase\u00f1a de cualquier cuenta. Los atacantes pueden enumerar cuentas de usuario a trav\u00e9s del endpoint de listado de usuarios y cambiar las credenciales de administrador para lograr una toma de control total de la cuenta y ejecuci\u00f3n de c\u00f3digo arbitrario."}], "lastModified": "2026-10-23T16:10:00.313", "sourceIdentifier": "disclosure@vulncheck.com"}