---
id: CVE-2026-75103
title: >-
  Crawlab fails to verify user ownership or administrative role on the
  password-change endpoint, allowing any authenticated user to reset any
  account's password
summary: >-
  Crawlab fails to verify user ownership or administrative role on the
  password-change endpoint, allowing any authenticated user to reset any
  account's password. Attackers can enumerate user accounts through the user
  listing endpoint and c…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-639
published: '2026-08-17'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:41.420'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75103'
references:
  - url: 'https://github.com/crawlab-team/crawlab'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/crawlab-team/crawlab/blob/main/core/controllers/user_v2.go
    label: disclosure@vulncheck.com
  - url: 'https://github.com/crawlab-team/crawlab/issues/1623'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/crawlab-missing-authorization-on-password-change-endpoint-allows-account-takeover
    label: disclosure@vulncheck.com
  - url: 'https://github.com/crawlab-team/crawlab/issues/1623'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00338
epssPercentile: 0.27368
ingestedAt: '2026-09-23T17:28:14.799Z'
vendor: crawlab-team
product: crawlab
affected:
  - crawlab <= 0.6.3
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-08-18T15:32:23.979290Z'
---

## Overview

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account takeover and arbitrary code execution.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.