An authorization bypass vulnerability in Crawlab allows any authenticated user to perform account takeovers by resetting passwords for arbitrary accounts.

The software fails to enforce proper authorization checks on the password-change endpoint (CWE-639), allowing an authenticated user to change the password of any account on the platform.

This vulnerability enables full account takeover, which can lead to complete system compromise, unauthorized data extraction, and the potential for lateral movement within the infrastructure. With a CVSS score of 8.8, this flaw constitutes a severe threat to both data integrity and system availability.

Immediate Action: Monitor vendor channels for a security update and apply it immediately upon release; until then, limit access to the system to trusted personnel only.

Proactive Monitoring: Review application logs for suspicious password change activities, specifically monitoring for multiple password resets occurring from a single low-privileged account.

Compensating Controls: Implement strict network access control lists (ACLs) to limit access to the administration interface and consider enforcing multi-factor authentication if supported by the platform.

Public Exploit Available: No (no confirmed public exploit or weaponized code in the available data).

Due to the extreme risk of account takeover and potential for full system compromise, this issue must be treated with high urgency. Administrators should restrict access to the platform and prepare to apply the vendor-provided patch as soon as it becomes available.