CVE-2026-75419

Deferred Deferred - Pending Action

Authorization Bypass in GoWind CMS

Publication date: 2026-08-28

Last updated on: 2026-09-01

Assigner: MITRE

Description

go-wind-cms (GoWind) before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer() function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine (noop.State{}), so the authz middleware always allows requests. Any authenticated user (regardless of role or tenant) can invoke administrative APIs such as deleting users, resetting passwords, and creating tenants.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-01

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-75419

EUVD

EUVD-2026-67324

Affected Vendors & Products

Vendor	Product	Version / Range
gowind	go-wind-cms	to 1.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-113	The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

Attack-Flow Graph

Executive Summary

CVE-2026-75419 is a missing authorization vulnerability in go-wind-cms (GoWind) versions before 1.0.0. The NewAuthorizer() function returns a no-op authorization engine that always allows requests, bypassing role and permission checks. This lets any authenticated user perform administrative actions regardless of their actual privileges.

Detection Guidance

Check if the NewAuthorizer() function in app/admin/service/internal/data/data.go or app/app/service/internal/data/data.go returns a no-op authorization engine (noop.State{}). Verify if the middleware chain uses this no-op engine for authorization checks. Inspect if the real Casbin/OPA authorization engine under pkg/authorizer/ is properly wired into the system.

Impact Analysis

An attacker with a valid account could delete users, reset passwords, create tenants, or grant admin privileges. This could lead to full system compromise, data loss, or unauthorized access to sensitive information across the multi-tenant platform.

Compliance Impact

This vulnerability likely violates compliance requirements for access controls in GDPR (data protection) and HIPAA (health information). It allows unauthorized users to access and modify sensitive data, which could result in regulatory fines and legal consequences due to inadequate security controls.

Mitigation Strategies

Update the NewAuthorizer() function to use a real Casbin/OPA authorization engine. Load the appropriate permission policy to restore proper RBAC functionality. Ensure the middleware chain uses the correct authorization engine instead of the no-op state.

Hi! I’m here to help you understand CVE-2026-75419. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70