Is CVE-2026-32639 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-32639 being exploited in the wild.

How severe is CVE-2026-32639?

Medium severity, with a CVSS score of 6.8, published 26 August 2026.

Which products and versions are affected?

winter/wn-cms-module (Packagist) <= 1.2.12, ECOSYSTEM:introduced=0,fixed=1.2.13; Winter CMS <= 1.2.12.

Is there a fix for CVE-2026-32639?

Yes. winter/wn-cms-module (Packagist): upgrade to 1.2.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-32639 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-32639?

Check whether you run winter/wn-cms-module (Packagist) or Winter CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32639: Winter CMS broken access control in Cms Controllers Index

Q: Is there a fix for CVE-2026-32639?

Yes. winter/wn-cms-module (Packagist): upgrade to 1.2.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-32639 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-32639?

Check whether you run winter/wn-cms-module (Packagist) or Winter CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32639 · Severity: medium · CVSS 6.8 · Published 2026-08-26

Winter CMS, a platform used for building and managing websites, contains a security flaw in its administrative interface. Users with limited administrative permissions can bypass restrictions to perform actions they are not authorized for, such as deleting website layouts or uploading unauthorized files. This could lead to unauthorized website modifications or the exposure of sensitive configuration files.

Technologies: winter/wn-cms-module (Packagist), Winter CMS. Vendors: Packagist, Winter CMS.

Quick answers

Is CVE-2026-32639 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-32639 being exploited in the wild.
How severe is CVE-2026-32639?: Medium severity, with a CVSS score of 6.8, published 26 August 2026.
Which products and versions are affected?: winter/wn-cms-module (Packagist) <= 1.2.12, ECOSYSTEM:introduced=0,fixed=1.2.13; Winter CMS <= 1.2.12.
Is there a fix for CVE-2026-32639?: Yes. winter/wn-cms-module (Packagist): upgrade to 1.2.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32639 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-32639?: Check whether you run winter/wn-cms-module (Packagist) or Winter CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

winter/wn-cms-module (Packagist): upgrade to 1.2.13 or later
```
composer require winter/wn-cms-module:^1.2.13
```

Technical details

A broken access control vulnerability exists in Winter CMS versions 1.2.12 and earlier. The `Cms\Controllers\Index` component used broad OR-logic for initial access but failed to implement per-template-type permission checks in specific AJAX handlers like `onSave()`, `onDelete()`, and `onDeleteTemplates()`. Additionally, the `AssetList` widget's `onUpload()` handler lacked theme validation, and the widget itself was registered for users without the `cms.manage_assets` permission. An attacker with any single CMS-related permission can exploit these omissions to modify or delete templates (pages, partials, layouts) and upload files to the active theme's asset directory. The issue is resolved in version 1.2.13.

Affected products

Winter CMS wn-cms-module <= 1.2.12

Identifiers

CVE-2026-32639
GHSA-5c4f-9pq9-6c77

Timeline

2026-08-07: disclosed: Initial disclosure by maintainers
2026-08-12: advisory: GitHub Advisory published
2026-08-12: patched: Fixed in version 1.2.13

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.