Winter CMS ImportExportController AJAX handlers permission bypass

Severity: high · CVSS 8.3 · Published 2026-08-20

Winter CMS's import/export feature, which allows administrators to move data in and out of the system, failed to properly check granular access permissions on certain backend handlers. An authenticated backend user who had basic access to a controller but lacked specific import or export privileges could circumvent the permission gates by calling underlying AJAX functions directly, allowing them to download entire databases or inject/modify records. This requires an existing backend account but bypasses intended administrative controls.

Technologies: winter/wn-backend-module (Packagist), Winter CMS Backend Module. Vendors: Packagist, Winter CMS.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 8.3, published 20 August 2026.
Which products and versions are affected?
winter/wn-backend-module (Packagist) <= 1.2.13; Winter CMS Backend Module ≤1.2.13.
Is there a fix for This vulnerability?
A patch was published on 2026-08-20: Fixed in v1.2.14 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network.
Am I affected?
Check whether you run winter/wn-backend-module (Packagist) or Winter CMS Backend Module at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass in the ImportExportController behavior affecting Winter CMS versions ≤1.2.13. The behavior supports granular access control via `import[permissions]` and `export[permissions]` configuration keys enforced by `userHasAccess()`, but this check was applied only to the page actions `import()` and `export()`. AJAX handlers (onImport, onImportLoadForm, onImportLoadColumnSampleForm, onExport, onExportLoadForm, download) were executed by `Backend\Classes\Controller::execAjaxHandlers()` before the page actions ran, bypassing the permission gate entirely. An authenticated backend user with access to such a controller through its coarse `$requiredPermissions` but denied the granular permission could invoke these handlers to exfiltrate data via export/download or modify records via import. CSRF tokens are still enforced, so the attacker must be logged in. The fix adds `userHasAccess()` checks to all affected handlers. Patched in v1.2.14.

Affected products

  • Winter CMS winter/wn-backend-module ≤1.2.13

Timeline

  • 2026-08-20: disclosed
  • 2026-08-20: patched: Fixed in v1.2.14

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.