# CVE-2026-35445: Winter CMS authorization bypass in Users controller

Source: https://junglewise.ai/threats/cve-2026-35445-winter-cms-authorization-bypass-in-users-controller  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-08-12  
License: CC BY 4.0 with a link back

CVE-2026-35445 · Severity: high · CVSS 4 · Published 2026-08-26

Winter CMS, a content management system, contains a vulnerability where authenticated backend users can bypass permission checks. This allows a user with limited access to perform administrative actions, such as deleting or restoring other user accounts and resetting passwords. This could lead to unauthorized account modifications and a loss of administrative control over the website.

Technologies: [winter/wn-backend-module (Packagist)](https://junglewise.ai/threats/technologies/winter-wn-backend-module), [Winter CMS Backend Module](https://junglewise.ai/threats/technologies/backend-module). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Winter CMS](https://junglewise.ai/threats/vendors/winter-cms).

## Quick answers

**Is CVE-2026-35445 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35445 being exploited in the wild.

**How severe is CVE-2026-35445?** High severity, with a CVSS score of 4, published 26 August 2026.

**Which products and versions are affected?** winter/wn-backend-module (Packagist) <= 1.2.12, ECOSYSTEM:introduced=0,fixed=1.2.13; Winter CMS Backend Module <= 1.2.12.

**Is there a fix for CVE-2026-35445?** Yes. winter/wn-backend-module (Packagist): upgrade to 1.2.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35445 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-35445?** Check whether you run winter/wn-backend-module (Packagist) or Winter CMS Backend Module at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- winter/wn-backend-module (Packagist): upgrade to 1.2.13 or later

  ```sh
  composer require winter/wn-backend-module:^1.2.13
  ```


## Technical details

The vulnerability exists because Winter CMS fails to validate the '_handler' POST field in the form postback mechanism, unlike the AJAX path which enforces a specific naming pattern. An authenticated attacker can exploit this by submitting a crafted POST request to call sensitive controller methods (e.g., update_onDelete, update_onManualPasswordReset) that are normally protected. This is particularly effective against the Users controller, which conditionally removes permission requirements for the 'myaccount' action, providing an entry point for users without 'backend.manage_users' permissions. The issue is fixed in version 1.2.13 by unifying handler validation and refactoring the Users controller.

## Affected products

- Winter CMS wn-backend-module <= 1.2.12

## Identifiers

- CVE-2026-35445
- GHSA-j5jq-cr68-v2xx

## Timeline

- 2026-08-07: disclosed: Initial disclosure by maintainers
- 2026-08-12: advisory: GitHub Advisory published
- 2026-08-12: patched: Fixed in v1.2.13

## References

- [https://api.github.com/users/everythingBlackkk](https://api.github.com/users/everythingBlackkk)
- [https://github.com/everythingBlackkk](https://github.com/everythingBlackkk)
- [https://api.github.com/users/everythingBlackkk/gists%7B/gist_id%7D](https://api.github.com/users/everythingBlackkk/gists%7B/gist_id%7D)
- [https://api.github.com/users/everythingBlackkk/repos](https://api.github.com/users/everythingBlackkk/repos)
- [https://avatars.githubusercontent.com/u/142638957?v=4](https://avatars.githubusercontent.com/u/142638957?v=4)
- [https://api.github.com/users/everythingBlackkk/events%7B/privacy%7D](https://api.github.com/users/everythingBlackkk/events%7B/privacy%7D)

## Related threats

- [Winter CMS local file inclusion via LESS @import directives](https://junglewise.ai/threats/cve-2026-63179-winter-cms-local-file-inclusion-via-less-import-directives)
- [Winter CMS FileUpload widget IDOR in attachment metadata](https://junglewise.ai/threats/cve-2026-54256-winter-cms-fileupload-widget-idor-in-attachment-metadata)
- [Winter CMS SQL injection in Backend Filter Widget numberrange scope](https://junglewise.ai/threats/cve-2026-32593-winter-cms-sql-injection-in-backend-filter-widget-numberrange)
- [Winter CMS stored XSS in Editor Settings custom styles](https://junglewise.ai/threats/cve-2026-32258-winter-cms-stored-xss-in-editor-settings-custom-styles)
- [Winter CMS stored XSS in Brand Settings custom styles](https://junglewise.ai/threats/cve-2026-32257-winter-cms-stored-xss-in-brand-settings-custom-styles)