What is CVE-2026-75103?

CVE-2026-75103 is a high-severity vulnerability in Crawlab-Team Crawlab, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 8.8/10. Published 2026-08-17.

How severe is CVE-2026-75103?

High severity. CVSS v3 base score is 8.8 out of 10.

Auth bypass in Crawlab-Team Crawlab

CVE-2026-75103

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account takeover and arbitrary code execution.

Vulnerability class: IDOR (Insecure Direct Object Reference)

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Crawlab-team Crawlab — versions 0

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

disclosure@vulncheck.com (issue-tracking)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-75103?: CVE-2026-75103 is a high-severity vulnerability in Crawlab-Team Crawlab, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 8.8/10. Published 2026-08-17.
How severe is CVE-2026-75103?: High severity. CVSS v3 base score is 8.8 out of 10.