{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/crawlab/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-75103"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Crawlab (0.6.3)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Crawlab"],"content_html":"\u003cp\u003eCrawlab, an open-source distributed web crawler platform, contains an authorization bypass vulnerability (CWE-639) affecting versions 0.6.3 and earlier. The flaw resides in the password-change endpoint, which fails to verify whether the requester owns the account or possesses administrative privileges. This design failure allows any authenticated user to change the password for any other user, including administrative accounts. An attacker who gains a foothold as a low-privileged user can leverage this endpoint to perform account takeover, obtain administrative access, and subsequently execute arbitrary code on the underlying server. This vulnerability is significant because it provides an easy path to full system compromise for any attacker with basic credentials.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker obtains valid credentials for a low-privileged account on the Crawlab instance.\u003c/li\u003e\n\u003cli\u003eAttacker logs into the Crawlab web interface using the acquired credentials.\u003c/li\u003e\n\u003cli\u003eAttacker accesses the user listing endpoint to identify existing accounts, specifically targeting accounts with administrative roles.\u003c/li\u003e\n\u003cli\u003eAttacker constructs an HTTP request targeting the vulnerable password-change endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker submits the password-change request with the target administrator's account identifier and a new, known password.\u003c/li\u003e\n\u003cli\u003eThe backend fails to validate the authorization of the request, updating the administrative account password.\u003c/li\u003e\n\u003cli\u003eAttacker logs into the system using the compromised administrator credentials.\u003c/li\u003e\n\u003cli\u003eAttacker leverages administrative functionality, such as custom crawler task management, to achieve arbitrary code execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-75103 results in complete account takeover, leading to unauthorized access to all crawler data and administrative control over the Crawlab instance. Because Crawlab is designed to execute custom code for scraping, an administrator can trigger remote code execution (RCE) on the server, potentially leading to full host compromise, lateral movement within the network, and exfiltration of sensitive harvested data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade Crawlab instances to the latest patched version to remediate CVE-2026-75103.\u003c/li\u003e\n\u003cli\u003eAudit access logs for the password-change endpoint to identify anomalous password reset activity originating from non-administrative users.\u003c/li\u003e\n\u003cli\u003eMonitor for unauthorized or suspicious user account enumeration requests via the Crawlab API endpoints.\u003c/li\u003e\n\u003cli\u003eEnforce strict network segmentation for web scraping infrastructure to limit the blast radius of a potential RCE event.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-17T22:51:18Z","date_published":"2026-08-17T22:51:18Z","id":"https://feed.craftedsignal.io/briefs/2026-08-crawlab-auth-bypass/","summary":"An authorization bypass vulnerability in Crawlab (CVE-2026-75103) allows authenticated users to reset the passwords of any account, enabling administrator takeover and subsequent arbitrary code execution.","title":"Authorization Bypass in Crawlab Password Change Endpoint","url":"https://feed.craftedsignal.io/briefs/2026-08-crawlab-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Crawlab","version":"https://jsonfeed.org/version/1.1"}