Crawlab EUVD-2026-60383

Exploitation requires that the attacker hold any valid authenticated session on the target Crawlab instance, corresponding to PR:L in the CVSS 4.0 vector - self-registration or compromise of any low-privilege account is sufficient. The attack additionally depends on the user-listing endpoint being accessible to authenticated non-administrator users, which the description implies is the default deployment behavior. No non-default configuration setting, optional feature flag, or special platform mode is required. Exploitation is bounded by the need for a valid session token (fully unauthenticated access is insufficient) and by network reachability of the Crawlab API (AV:N). Deployments placed behind a network perimeter that restricts API access to trusted hosts, or instances where the user-listing endpoint has been locked down to administrator roles, would substantially limit exploitability in practice.

The CVSS 4.0 score of 8.7 (High) is broadly appropriate but may understate post-exploitation blast radius: the supplied vector (AV:N/AC:L/AT:N/PR:L/UI:N) correctly captures a network-reachable, low-complexity, low-privilege attack with no user interaction, but marks subsequent-system impact as None (SC:N/SI:N/SA:N). This is arguably conservative given that Crawlab's core function is distributing code execution to worker nodes - administrator account takeover effectively extends attacker control beyond the application boundary to those managed hosts. No EPSS score was provided, so exploitation probability cannot be quantified numerically; however, the IDOR technique requires no specialized tooling and is well understood by even low-skill attackers. No CISA KEV listing is present, indicating no confirmed active exploitation at time of analysis. The CPE wildcard (*:*) means no safe downgrade path exists, and no patched release version has been confirmed in the available data, elevating urgency for network-level mitigations in the interim.

An attacker who registers or compromises any low-privilege Crawlab account issues a GET request to the user-listing endpoint to retrieve all user IDs and identifies the administrator account. The attacker then sends a PATCH or PUT request to the password-change endpoint targeting the administrator's user ID with an attacker-controlled password, receiving a successful response with no authorization error. Authenticated as the platform administrator, the attacker creates and schedules a malicious crawler task containing arbitrary shell commands, which are executed on all connected Crawlab worker nodes.