Executive brief
Winter CMS's import/export feature, which allows administrators to move data in and out of the system, failed to properly check granular access permissions on certain backend handlers. An authenticated backend user who had basic access to a controller but lacked specific import or export privileges could circumvent the permission gates by calling underlying AJAX functions directly, allowing them to download entire databases or inject/modify records. This requires an existing backend account but bypasses intended administrative controls.
Technical details
The vulnerability is an authorization bypass in the ImportExportController behavior affecting Winter CMS versions ≤1.2.13. The behavior supports granular access control via `import[permissions]` and `export[permissions]` configuration keys enforced by `userHasAccess()`, but this check was applied only to the page actions `import()` and `export()`. AJAX handlers (onImport, onImportLoadForm, onImportLoadColumnSampleForm, onExport, onExportLoadForm, download) were executed by `Backend\Classes\Controller::execAjaxHandlers()` before the page actions ran, bypassing the permission gate entirely. An authenticated backend user with access to such a controller through its coarse `$requiredPermissions` but denied the granular permission could invoke these handlers to exfiltrate data via export/download or modify records via import. CSRF tokens are still enforced, so the attacker must be logged in. The fix adds `userHasAccess()` checks to all affected handlers. Patched in v1.2.14.
Affected products
- Winter CMS winter/wn-backend-module ≤1.2.13
Timeline
- 2026-08-20: disclosed
- 2026-08-20: patched: Fixed in v1.2.14