The crawler task creation API 'api add crawler task' contains an insufficient authorization check when a user provides a cookiejar UUID for a one-shot or scheduled crawler task. The system fails to validate organizational boundaries or the requesting user's role. Specifically, if the cookiejar access level is not 0, no access check is performed; if it is 0, the system only compares the owning user ID to the requesting user ID. An authenticated user with the ability to create crawler tasks who knows or guesses a valid cookiejar UUID from another organization can force the crawler to use that organization's stored cookies, such as session tokens and authentication credentials, leading to the exfiltration of session data.