Description

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account takeover and arbitrary code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-17T21:16:49.200Z",
  "pubdate": "2026-08-17T21:16:49.200Z",
  "executiveSummary": "An improper authorization vulnerability has been identified in Crawlab, specifically residing within the password-change endpoint. The flaw stems from a complete lack of verification regarding user ownership and administrative privileges during the password modification process. Consequently, any authenticated user can successfully alter the credentials of arbitrary accounts within the system. The impact of this security deficiency is critical, as it enables full account takeover across the platform. An attacker can leverage the application's user listing endpoint to systematically enumerate valid user accounts, identify administrative profiles, and subsequently overwrite their passwords. The risk implications are severe, allowing unauthorized actors to compromise administrator-level sessions and ultimately execute arbitrary code within the underlying environment. Exploitation of this vulnerability requires authenticated access to the application, but no prior administrative privileges are necessary, drastically lowering the barrier for exploitation. Affected systems include deployments of Crawlab lacking proper access control enforcement on sensitive credential management interfaces.",
  "technicalDetails": "The vulnerability is rooted in an authorization bypass flaw within the password-change endpoint of Crawlab. The core technical defect is the failure of the backend application logic to validate whether the user initiating the password change request matches the target account owner, or alternatively, whether the requesting session possesses authorized administrative privileges. Due to this missing access control check, the endpoint blindly processes incoming modification requests for any specified user identifier.\nThe attack flow proceeds in a sequential, deterministic manner. First, an attacker leverages the application's user listing endpoint, which lacks adequate restriction or visibility limitations, to harvest valid usernames and user IDs present in the system. Following successful enumeration, the attacker crafts a malicious HTTP request directed at the vulnerable password-change endpoint. By supplying a target victim's username or identifier alongside a new password payload, the attacker bypasses standard self-service password reset mechanisms that would normally require verification of the old password or out-of-band confirmation.\nBecause standard authenticated users possess the capability to target administrative accounts through this oversight, an attacker can directly overwrite the credentials of a high-privileged administrator. Once the administrator account is compromised, the attacker can authenticate with the newly established credentials and leverage legitimate administrative features of Crawlab designed for job execution or node management. This post-exploitation state grants the attacker the ability to achieve arbitrary code execution on the host infrastructure, fulfilling a complete system compromise scenario."
}