The vulnerability in Crawlab's password‑change endpoint allows any authenticated user to change the password of any account without verifying ownership or administrative privilege. This enables attackers to take over administrator accounts and ultimately execute arbitrary code on the system. The weakness is based on improper authorization checks, classified as CWE‑639, and is rated high severity with a CVSS score of 8.7.

The flaw affects Crawlab software from the crawlab‑team. No specific product version is listed, so all current releases that include the vulnerable implementation are potentially exposed. Users should verify whether their deployed version contains the unpatched user_v2.go controller and consider applying a fix at the earliest convenience.

Because the exploit requires only that the attacker be an authenticated user, the risk of exploitation is high once an initial credential is compromised. The vulnerability is not listed in the CISA KEV catalog and no EPSS score is available, but the high CVSS magnitude signals significant impact. Attackers can enumerate accounts via the user listing endpoint and trigger password resets, which can lead to complete account takeover and control over the Crawlab instance.