# CVE-2026-32639: Winter CMS broken access control in Cms Controllers Index

Source: https://junglewise.ai/threats/cve-2026-32639-winter-cms-broken-access-control-in-cms-controllers-index  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-08-12  
License: CC BY 4.0 with a link back

CVE-2026-32639 · Severity: medium · CVSS 6.8 · Published 2026-08-26

Winter CMS, a platform used for building and managing websites, contains a security flaw in its administrative interface. Users with limited administrative permissions can bypass restrictions to perform actions they are not authorized for, such as deleting website layouts or uploading unauthorized files. This could lead to unauthorized website modifications or the exposure of sensitive configuration files.

Technologies: [winter/wn-cms-module (Packagist)](https://junglewise.ai/threats/technologies/winter-wn-cms-module), [Winter CMS](https://junglewise.ai/threats/technologies/winter-cms). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Winter CMS](https://junglewise.ai/threats/vendors/winter-cms).

## Quick answers

**Is CVE-2026-32639 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32639 being exploited in the wild.

**How severe is CVE-2026-32639?** Medium severity, with a CVSS score of 6.8, published 26 August 2026.

**Which products and versions are affected?** winter/wn-cms-module (Packagist) <= 1.2.12, ECOSYSTEM:introduced=0,fixed=1.2.13; Winter CMS <= 1.2.12.

**Is there a fix for CVE-2026-32639?** Yes. winter/wn-cms-module (Packagist): upgrade to 1.2.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-32639 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-32639?** Check whether you run winter/wn-cms-module (Packagist) or Winter CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- winter/wn-cms-module (Packagist): upgrade to 1.2.13 or later

  ```sh
  composer require winter/wn-cms-module:^1.2.13
  ```


## Technical details

A broken access control vulnerability exists in Winter CMS versions 1.2.12 and earlier. The `Cms\Controllers\Index` component used broad OR-logic for initial access but failed to implement per-template-type permission checks in specific AJAX handlers like `onSave()`, `onDelete()`, and `onDeleteTemplates()`. Additionally, the `AssetList` widget's `onUpload()` handler lacked theme validation, and the widget itself was registered for users without the `cms.manage_assets` permission. An attacker with any single CMS-related permission can exploit these omissions to modify or delete templates (pages, partials, layouts) and upload files to the active theme's asset directory. The issue is resolved in version 1.2.13.

## Affected products

- Winter CMS wn-cms-module <= 1.2.12

## Identifiers

- CVE-2026-32639
- GHSA-5c4f-9pq9-6c77

## Timeline

- 2026-08-07: disclosed: Initial disclosure by maintainers
- 2026-08-12: advisory: GitHub Advisory published
- 2026-08-12: patched: Fixed in version 1.2.13

## References

- [https://api.github.com/users/Vincent550102](https://api.github.com/users/Vincent550102)
- [https://github.com/Vincent550102](https://github.com/Vincent550102)
- [https://api.github.com/users/Vincent550102/gists%7B/gist_id%7D](https://api.github.com/users/Vincent550102/gists%7B/gist_id%7D)
- [https://api.github.com/users/Vincent550102/repos](https://api.github.com/users/Vincent550102/repos)
- [https://avatars.githubusercontent.com/u/48404862?v=4](https://avatars.githubusercontent.com/u/48404862?v=4)
- [https://api.github.com/users/Vincent550102/events%7B/privacy%7D](https://api.github.com/users/Vincent550102/events%7B/privacy%7D)

## Related threats

- [Winter CMS MyAccount controller information disclosure](https://junglewise.ai/threats/cve-2026-126061-winter-cms-is-a-content-management-system-built-on-the-laravel)
- [Winter CMS reflected XSS in Table widget search parameter](https://junglewise.ai/threats/cve-2026-125340-winter-cms-is-a-content-management-system-built-on-the-laravel)
- [Winter CMS CSRF via unvalidated backend handler invocation](https://junglewise.ai/threats/cve-2026-125339-winter-cms-is-a-content-management-system-built-on-the-laravel)
- [Winter CMS stored XSS in backend brand and editor settings](https://junglewise.ai/threats/cve-2026-125338-winter-cms-is-a-content-management-system-built-on-the-laravel)
- [Winter CMS local file inclusion via LESS @import directives](https://junglewise.ai/threats/cve-2026-63179-winter-cms-local-file-inclusion-via-less-import-directives)