Executive brief
GoWind is an open-source content management system with multi-tenant and role-based administration features. A critical flaw in the authorization engine causes it to accept all authenticated requests regardless of user role or permissions, allowing any user with a valid login token to perform administrative actions like deleting accounts, resetting passwords, and creating new tenants with unrestricted access.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the authorization middleware. The NewAuthorizer() function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine (noop.State{}) instead of a real RBAC implementation. The middleware chain applies this no-op engine for authorization checks, causing IsAuthorized() to always return true. As a result, any authenticated user—regardless of role or tenant assignment—can invoke all administrative APIs. A real authorization engine exists in the codebase (pkg/authorizer/) but is never wired into the middleware chain. Exploitation requires only a valid JWT access token and network access to the admin API endpoints. Fixes involve replacing the no-op engine with a real casbin or OPA-based authorization engine and loading the role-based permission policy.
Affected products
- GoWind go-wind-cms before 1.0.0
Timeline
- 2026-08-14: disclosed: Issue opened on GitHub
- 2026-08-28: advisory: CVE-2026-75419 published