CVE-2026-75103

creationtimestamp| type| source ---|---|--- 2026-08-18 06:01:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtdk4e2vr32b 2026-08-20 04:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtieaz3mql25...

CVE-2026-75103 Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account...