Snews CMS version 1.7 contains a cross‑site request forgery vulnerability that permits an attacker to modify the administrator username and password without authenticating. By delivering a crafted HTML form that submits POST data to the changeup action, a malicious page can force an authenticated administrator to unknowingly change their own credentials. The resulting unauthorized access compromises the confidentiality and control of the CMS administrative interface.

Snewscms Snews CMS version 1.7 is adversely affected by this vulnerability; other unlisted versions are not confirmed to be vulnerable.

The vulnerability has a CVSS score of 6.9 and an EPSS score below 1 %, indicating a moderate severity and a low likelihood of exploitation. It is suggested that the attack vector is a web‑based CSRF, requiring a user who is already logged in as an administrator to visit a malicious page. Since the exploit relies on user interaction with a forged form, the practical risk is limited but still significant due to the potential loss of administrative control.