CVE-2025-70997: High severity eladmin vulnerability
Published Feb 4, 2026
·Updated
A vulnerability has been discovered in eladmin v2.7 and before. This vulnerability allows for an arbitrary user password reset under any user permission level.
Affected Software
2 affected components
eladmin<2.7
eladmin eladmin<=2.7
Event History
Feb 4, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-70997?
CVE-2025-70997 is considered a high-severity vulnerability due to its potential for unauthorized password resets.
2
How do I fix CVE-2025-70997?
To fix CVE-2025-70997, update eladmin to version 2.8 or later where this vulnerability has been addressed.
3
What versions of eladmin are affected by CVE-2025-70997?
CVE-2025-70997 affects eladmin version 2.7 and all earlier versions.
4
What can attackers do with CVE-2025-70997?
Attackers can exploit CVE-2025-70997 to reset passwords for any user without proper permission checks.
5
Is CVE-2025-70997 easy to exploit?
Yes, CVE-2025-70997 is relatively easy to exploit, making it a significant security concern for affected users.