What is the CVSS score of CVE-2025-70833?

CVE-2025-70833 has a CVSS 3.1 base score of 9.4 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-70833?

A critical authentication bypass vulnerability in Smanga 3.2.7 allows attackers to reset any user password, including administrator accounts, without authentication.

How to fix or mitigate CVE-2025-70833?

Within 24 hours: Isolate affected Smanga instances from production networks or disable external access; inventory all systems running version 3.2.7. Within 7 days: Implement network-based access controls restricting access to check-power.php; enable comprehensive audit logging for authentication events; notify users to monitor accounts for unauthorized access. Within 30 days: Upgrade to a patched version once available; if upgrade unavailable, evaluate replacing Smanga with a supported alternative; conduct forensic analysis for evidence of compromise.

PHP CVE-2025-70833

CRITICAL

Improper Authentication (CWE-287)

2026-02-20 cve@mitre.org

PHP Authentication Bypass Smanga

9.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.4 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

CVE Published

Feb 20, 2026 - 17:25 nvd

CRITICAL 9.4

DescriptionCVE.org

An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the administrator) and fully takeover the account by manipulating POST parameters. The issue stems from insecure permission validation in check-power.php.