CVE-2026-32639

Deferred Deferred - Pending Action

Theme Editor Permission Bypass in Winter CMS

Publication date: 2026-08-26

Last updated on: 2026-09-09

Assigner: GitHub, Inc.

Description

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Theme Editor AJAX handlers did not enforce per-template-type permission checks, allowing a backend user with any single CMS permission to act on template types outside their authorized scope. The CMS controller gated access to the section as a whole using OR-logic across its five permissions, but individual handlers such as onSave(), onDelete(), and onDeleteTemplates() did not verify that the user held the specific permission for the requested template type, so a user with only cms.manage_pages could craft AJAX requests to delete layouts, modify partials, or read content files. Separately, the AssetList widget was registered for any user who passed the controller gate regardless of the cms.manage_assets permission, and its onUpload() handler omitted the theme-validation call present on the other mutating handlers, permitting unauthorized file uploads into the active theme's asset directory. Exploitation requires an authenticated backend account holding at least one of the CMS Theme Editor permissions. This issue is fixed in version 1.2.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-09-09

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-32639

Affected Vendors & Products

Vendor	Product	Version / Range
wintercms	winter	to 1.2.12 (inc)
wintercms	winter	1.2.13

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-289	The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.

Attack-Flow Graph

Executive Summary

Winter CMS versions up to 1.2.12 have a permission bypass in the Theme Editor AJAX handlers. The system checks for any CMS permission using OR-logic but fails to enforce specific template-type permissions. This allows users with limited permissions, like cms.manage_pages, to perform actions outside their authorized scope, such as deleting layouts or modifying partials.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized actions in Winter CMS Theme Editor. Review server logs for suspicious AJAX requests targeting /backend/cms/ with actions like onSave(), onDelete(), or onDeleteTemplates(). Look for file uploads via AssetList widget without proper permission checks. Verify user permissions in the backend to ensure only authorized users have CMS Theme Editor permissions.

Impact Analysis

An attacker with a backend account and at least one CMS permission could exploit this to modify or delete template files, upload unauthorized files to the theme's asset directory, or access sensitive content files. This could lead to website defacement, data leakage, or further compromise of the system.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations using affected versions may face compliance violations, data breaches, and potential legal penalties.

Mitigation Strategies

Immediately update Winter CMS to version 1.2.13 or later. Review and restrict backend user permissions to ensure users only have the minimum required CMS permissions. Audit server logs for signs of exploitation, particularly unauthorized file uploads or template modifications. Remove or disable any unused CMS Theme Editor accounts.

Hi! I’m here to help you understand CVE-2026-32639. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70