Is CVE-2026-35445 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35445 being exploited in the wild.

How severe is CVE-2026-35445?

High severity, with a CVSS score of 4, published 26 August 2026.

Which products and versions are affected?

winter/wn-backend-module (Packagist) <= 1.2.12, ECOSYSTEM:introduced=0,fixed=1.2.13; Winter CMS Backend Module <= 1.2.12.

Is there a fix for CVE-2026-35445?

Yes. winter/wn-backend-module (Packagist): upgrade to 1.2.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35445 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-35445?

Check whether you run winter/wn-backend-module (Packagist) or Winter CMS Backend Module at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35445: Winter CMS authorization bypass in Users controller

Q: Is there a fix for CVE-2026-35445?

Yes. winter/wn-backend-module (Packagist): upgrade to 1.2.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-35445 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-35445?

Check whether you run winter/wn-backend-module (Packagist) or Winter CMS Backend Module at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35445 · Severity: high · CVSS 4 · Published 2026-08-26

Winter CMS, a content management system, contains a vulnerability where authenticated backend users can bypass permission checks. This allows a user with limited access to perform administrative actions, such as deleting or restoring other user accounts and resetting passwords. This could lead to unauthorized account modifications and a loss of administrative control over the website.

Technologies: winter/wn-backend-module (Packagist), Winter CMS Backend Module. Vendors: Packagist, Winter CMS.

Quick answers

Is CVE-2026-35445 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35445 being exploited in the wild.
How severe is CVE-2026-35445?: High severity, with a CVSS score of 4, published 26 August 2026.
Which products and versions are affected?: winter/wn-backend-module (Packagist) <= 1.2.12, ECOSYSTEM:introduced=0,fixed=1.2.13; Winter CMS Backend Module <= 1.2.12.
Is there a fix for CVE-2026-35445?: Yes. winter/wn-backend-module (Packagist): upgrade to 1.2.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35445 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-35445?: Check whether you run winter/wn-backend-module (Packagist) or Winter CMS Backend Module at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

winter/wn-backend-module (Packagist): upgrade to 1.2.13 or later
```
composer require winter/wn-backend-module:^1.2.13
```

Technical details

The vulnerability exists because Winter CMS fails to validate the '_handler' POST field in the form postback mechanism, unlike the AJAX path which enforces a specific naming pattern. An authenticated attacker can exploit this by submitting a crafted POST request to call sensitive controller methods (e.g., update_onDelete, update_onManualPasswordReset) that are normally protected. This is particularly effective against the Users controller, which conditionally removes permission requirements for the 'myaccount' action, providing an entry point for users without 'backend.manage_users' permissions. The issue is fixed in version 1.2.13 by unifying handler validation and refactoring the Users controller.

Affected products

Winter CMS wn-backend-module <= 1.2.12

Identifiers

CVE-2026-35445
GHSA-j5jq-cr68-v2xx

Timeline

2026-08-07: disclosed: Initial disclosure by maintainers
2026-08-12: advisory: GitHub Advisory published
2026-08-12: patched: Fixed in v1.2.13

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.