CVE-2026-35445

Deferred Deferred - Pending Action

Authenticated Method Invocation in Winter CMS

Publication date: 2026-08-26

Last updated on: 2026-09-09

Assigner: GitHub, Inc.

Description

Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback _handler POST field, allowing an authenticated backend user to invoke arbitrary controller methods, including protected, private, and action-prefixed ones. While AJAX requests validate that handler names match the on[A-Z][\w+]* pattern, the postback path passed the submitted _handler value straight to the handler dispatcher with no such check, so any controller that exposes a public action or conditionally relaxes its $requiredPermissions check could be reached, bypassing the roles and permissions system. The built-in Users controller was affected because it set $requiredPermissions to null for the myaccount action, letting any authenticated backend user invoke user-management methods such as update_onDelete and update_onManualPasswordReset without holding the backend.manage_users permission. This issue is fixed in version 1.2.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-09-09

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-35445

EUVD

EUVD-2026-66631

Affected Vendors & Products

Vendor	Product	Version / Range
winter_cms	winter_cms	1.2.13
winter_cms	winter	to 1.2.13 (exc)
winter_cms	winter	1.2.13

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Winter CMS versions before 1.2.13 have an authentication bypass vulnerability. The backend fails to validate the handler name submitted via the _handler POST field during form postback. This allows an authenticated user to call any controller method, including protected or private ones, bypassing role and permission checks. The Users controller was particularly affected because its myaccount action had no required permissions, letting users invoke sensitive methods like update_onDelete without proper authorization.

Detection Guidance

Check Winter CMS versions prior to 1.2.13 by inspecting the version in the application files or database. Monitor backend logs for unauthorized access attempts or unusual controller method invocations, particularly targeting the Users controller actions like update_onDelete or update_onManualPasswordReset.

Impact Analysis

An attacker with backend access could exploit this to perform unauthorized actions such as deleting users, resetting passwords, or modifying user accounts without the required permissions. This could lead to data breaches, unauthorized access to sensitive information, or complete system compromise depending on the exposed methods.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to personal or sensitive data. GDPR requires strict access controls and data protection; HIPAA mandates role-based access for protected health information. Exploitation could lead to unauthorized data exposure, resulting in regulatory fines or legal consequences.

Mitigation Strategies

Upgrade Winter CMS to version 1.2.13 or later immediately. Review and restrict backend user permissions, ensuring no accounts have unnecessary access to sensitive controller methods. Audit logs for any signs of exploitation and remove unauthorized user accounts if detected.

Hi! I’m here to help you understand CVE-2026-35445. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70