CVE-2025-70833

CRITICAL

Smanga 3.2.7 - Auth Bypass

Title source: llm

Description

An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the administrator) and fully takeover the account by manipulating POST parameters. The issue stems from insecure permission validation in check-power.php.

References (1)

[Issue Tracking] https://github.com/LX-66-LX/cve/issues/4

Scores

CVSS v3 9.4

EPSS 0.0010

EPSS Percentile 27.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Classification

CWE

CWE-639 CWE-287

Status published

Affected Products (1)

lkw199711/smanga

Timeline

Published Feb 20, 2026

Tracked Since Feb 21, 2026