{"id":"CVE-2026-75103","title":"Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password","summary":"Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and c…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-639"],"published":"2026-08-17","updated":"2026-09-23","sourceUpdated":"2026-09-23T17:17:41.420","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75103","references":[{"url":"https://github.com/crawlab-team/crawlab","label":"disclosure@vulncheck.com"},{"url":"https://github.com/crawlab-team/crawlab/blob/main/core/controllers/user_v2.go","label":"disclosure@vulncheck.com"},{"url":"https://github.com/crawlab-team/crawlab/issues/1623","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/crawlab-missing-authorization-on-password-change-endpoint-allows-account-takeover","label":"disclosure@vulncheck.com"},{"url":"https://github.com/crawlab-team/crawlab/issues/1623","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00338,"epssPercentile":0.27368,"ingestedAt":"2026-09-23T17:28:14.799Z","slug":"CVE-2026-75103","body":"## Overview\n\nCrawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account takeover and arbitrary code execution.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}