EUVD-2026-60383
GHSA-jm7g-x36v-768h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L because any valid session suffices; S:C because admin takeover propagates code execution authority to managed distributed worker hosts outside the application boundary.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account takeover and arbitrary code execution.
AnalysisAI
Broken object-level authorization on Crawlab's password-change endpoint allows any authenticated user to overwrite the credentials of any platform account, including administrators, without ownership or role verification. The attack is a two-step IDOR chain: enumerate user IDs through an unrestricted user-listing endpoint, then submit a password-change request targeting the administrator account ID. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker hold any valid authenticated session on the target Crawlab instance, corresponding to PR:L in the CVSS 4.0 vector - self-registration or compromise of any low-privilege account is sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (High) is broadly appropriate but may understate post-exploitation blast radius: the supplied vector (AV:N/AC:L/AT:N/PR:L/UI:N) correctly captures a network-reachable, low-complexity, low-privilege attack with no user interaction, but marks subsequent-system impact as None (SC:N/SI:N/SA:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who registers or compromises any low-privilege Crawlab account issues a GET request to the user-listing endpoint to retrieve all user IDs and identifies the administrator account. The attacker then sends a PATCH or PUT request to the password-change endpoint targeting the administrator's user ID with an attacker-controlled password, receiving a successful response with no authorization error. … |
| Remediation | No vendor-released patch has been independently confirmed at time of analysis; monitor https://github.com/crawlab-team/crawlab/issues/1623 and the upstream repository at https://github.com/crawlab-team/crawlab for a tagged release addressing this flaw. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Restrict network access to Crawlab's password-change endpoint to authorized administrative hosts and enable detailed audit logging on all authentication attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today