Executive brief
Winter CMS, a content management system, contains a vulnerability where authenticated backend users can bypass permission checks. This allows a user with limited access to perform administrative actions, such as deleting or restoring other user accounts and resetting passwords. This could lead to unauthorized account modifications and a loss of administrative control over the website.
Technical details
The vulnerability exists because Winter CMS fails to validate the '_handler' POST field in the form postback mechanism, unlike the AJAX path which enforces a specific naming pattern. An authenticated attacker can exploit this by submitting a crafted POST request to call sensitive controller methods (e.g., update_onDelete, update_onManualPasswordReset) that are normally protected. This is particularly effective against the Users controller, which conditionally removes permission requirements for the 'myaccount' action, providing an entry point for users without 'backend.manage_users' permissions. The issue is fixed in version 1.2.13 by unifying handler validation and refactoring the Users controller.
Affected products
- Winter CMS wn-backend-module <= 1.2.12
Timeline
- 2026-08-07: disclosed: Initial disclosure by maintainers
- 2026-08-12: advisory: GitHub Advisory published
- 2026-08-12: patched: Fixed in v1.2.13
References
- https://api.github.com/users/everythingBlackkk
- https://github.com/everythingBlackkk
- https://api.github.com/users/everythingBlackkk/gists%7B/gist_id%7D
- https://api.github.com/users/everythingBlackkk/repos
- https://avatars.githubusercontent.com/u/142638957?v=4
- https://api.github.com/users/everythingBlackkk/events%7B/privacy%7D