High severity8.8NVD Advisory· Published Aug 17, 2026

CVE-2026-75103

Description

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account takeover and arbitrary code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Crawlab Team/crawlabllm-create

Patches

Vulnerability mechanics

References

github.com/crawlab-team/crawlab/blob/main/core/controllers/user_v2.gonvd
github.com/crawlab-team/crawlab/issues/1623nvd
www.vulncheck.com/advisories/crawlab-missing-authorization-on-password-change-endpoint-allows-account-takeovernvd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000