CVE-2026-75103 is an authorization bypass vulnerability in crawlab (up to version 0.6.3) where the password-change endpoint does not verify if the requesting user owns the account or has administrative rights. This allows any authenticated user to reset passwords for any account. Attackers can enumerate user accounts via the user listing endpoint and exploit this to change administrator credentials, resulting in full account takeover and arbitrary code execution. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with any authenticated access can reset passwords of arbitrary accounts, including administrators, leading to full account compromise. This can result in unauthorized access, privilege escalation, and arbitrary code execution within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user access to trusted individuals only and monitor for suspicious password reset activities. Avoid exposing the password-change endpoint to untrusted users.