{"id":"CVE-2026-35445","aliases":["EUVD-2026-66631","GHSA-j5jq-cr68-v2xx"],"status":"published","title":"Winter: Authenticated backend users can bypass Users controller permission checks","description":"Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback _handler POST field, allowing an authenticated backend user to invoke arbitrary controller methods, including protected, private, and action-prefixed ones. While AJAX requests validate that handler names match the on[A-Z][\\w+]* pattern, the postback path passed the submitted _handler value straight to the handler dispatcher with no such check, so any controller that exposes a public action or conditionally relaxes its $requiredPermissions check could be reached, bypassing the roles and permissions system. The built-in Users controller was affected because it set $requiredPermissions to null for the myaccount action, letting any authenticated backend user invoke user-management methods such as update_onDelete and update_onManualPasswordReset without holding the backend.manage_users permission. This issue is fixed in version 1.2.13.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00439,"percentile":0.386,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-285","CWE-639"],"published":"2026-08-12T15:15:17Z","modified":"2026-10-28T02:30:48Z","fixes":[{"ecosystem":"Packagist","package":"winter/wn-backend-module","fixed_in":["1.2.13"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"winter/wn-backend-module","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.12"},{"fixed":"1.2.13"}]}]},{"source":"osv","ecosystem":"Packagist","package":"winter/wn-backend-module","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.13"}]}],"versions":["v1.0.473","v1.0.474","v1.0.475","v1.1.10","v1.1.11","v1.1.2","v1.1.3","v1.1.4","v1.1.5","v1.1.6","v1.1.7","v1.1.8","v1.1.9","v1.2.0","v1.2.1","v1.2.10","v1.2.11","v1.2.12","v1.2.2","v1.2.3","v1.2.4","v1.2.5","v1.2.6","v1.2.7","v1.2.8","v1.2.9"]}],"products":[{"vendor":"wintercms","product":"winter"}],"references":[{"url":"https://github.com/wintercms/winter/security/advisories/GHSA-j5jq-cr68-v2xx","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/wintercms/winter/pull/1473","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/wintercms/winter/releases/tag/v1.2.13","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-j5jq-cr68-v2xx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35445.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35445","tags":["advisory"]},{"url":"https://github.com/wintercms/winter","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-35445","title":"Winter: Authenticated backend users can bypass Users controller permission checks","description":"Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback _handler POST field, allowing an authenticated backend user to invoke arbitrary controller methods, including protected, private, and action-prefixed ones. While AJAX requests validate that handler names match the on[A-Z][\\w+]* pattern, the postback path passed the submitted _handler value straight to the handler dispatcher with no such check, so any controller that exposes a public action or conditionally relaxes its $requiredPermissions check could be reached, bypassing the roles and permissions system. The built-in Users controller was affected because it set $requiredPermissions to null for the myaccount action, letting any authenticated backend user invoke user-management methods such as update_onDelete and update_onManualPasswordReset without holding the backend.manage_users permission. This issue is fixed in version 1.2.13.","status":"published","published":"2026-08-26T16:40:51.5Z","modified":"2026-08-26T19:08:44.974Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:20:05.15083Z"}],"euvd":[{"id":"EUVD-2026-66631","description":"Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback _handler POST field, allowing an authenticated backend user to invoke arbitrary controller methods, including protected, private, and action-prefixed ones. While AJAX requests validate that handler names match the on[A-Z][\\w+]* pattern, the postback path passed the submitted _handler value straight to the handler dispatcher with no such check, so any controller that exposes a public action or conditionally relaxes its $requiredPermissions check could be reached, bypassing the roles and permissions system. The built-in Users controller was affected because it set $requiredPermissions to null for the myaccount action, letting any authenticated backend user invoke user-management methods such as update_onDelete and update_onManualPasswordReset without holding the backend.manage_users permission. This issue is fixed in version 1.2.13.","status":"published","published":"2026-08-26T16:40:51Z","modified":"2026-08-26T19:08:44Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:29.635922Z"}],"ghsa":[{"id":"GHSA-j5jq-cr68-v2xx","title":"Winter: Authenticated backend users can bypass Users controller permission checks","description":"### Impact\n\nAffected versions of Winter CMS did not validate the handler name submitted through the form postback mechanism (`_handler` POST field) in the same way as AJAX requests (`X_WINTER_REQUEST_HANDLER` header). The AJAX path validates that handler names match the `on[A-Z][\\w+]*` pattern, but the postback path passed the handler name directly to the handler dispatcher with no validation.\n\nThis allowed an authenticated backend user to call any method on a controller — including action-prefixed, protected, and private methods — by submitting a crafted POST request with a `_handler` field, as long as the controller either:\n\n- Contains a publicly available action via the `$publicActions` property, or\n- Degrades or removes the `$requiredPermissions` check in its constructor based on a condition\n\nThe backend's own Users controller was affected by the second scenario: it set `$requiredPermissions` to `null` for the `myaccount` action, allowing any authenticated backend user to access the controller without the `backend.manage_users` permission. Combined with the postback bypass, this allowed calling controller methods such as `update_onDelete`, `update_onRestore`, `update_onUnsuspendUser`, and `update_onManualPasswordReset` with attacker-controlled parameters.\n\nNote that CSRF tokens are still verified on all POST requests, so the attacker must be logged into the backend with a valid session.\n\nTo actively exploit this security issue, an attacker would need access to the Backend with a user account with any level of access.\n\nThe Winter CMS maintainers strongly recommend that all Winter CMS sites that have any reliance on the roles \u0026 permissions system to update immediately. Security fixes have been backported to all major versions of Winter (1.0, 1.1, and 1.2).\n\n### Patches\n\nThe postback handler path now validates handler names using the same rules as the AJAX path. The My Account functionality has been moved to a dedicated controller that does not expose user management methods. Defence in depth has been applied at the model level to prevent unauthorized user record modifications regardless of the entry point.\n\nThis security issue has been fixed as of v1.2.13.\n\n### Workarounds\n\nIf users cannot upgrade, they may apply the following changes to their Winter CMS installation manually to resolve this issue:\n\n1. In `modules/backend/classes/Controller.php`, validate the `_handler` POST field against the `on[A-Z][\\w+]*` pattern before passing it to `runAjaxHandler()`.\n2. In `modules/backend/controllers/Users.php`, remove the conditional that sets `$requiredPermissions` to `null` for the `myaccount` action.","status":"published","published":"2026-08-12T15:15:17Z","modified":"2026-08-12T15:15:19Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","level":"high"}],"cwes":["CWE-285","CWE-639"],"updated_at":"2026-11-02T14:40:58.888637Z"}],"nvd":[{"id":"CVE-2026-35445","description":"Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback _handler POST field, allowing an authenticated backend user to invoke arbitrary controller methods, including protected, private, and action-prefixed ones. While AJAX requests validate that handler names match the on[A-Z][\\w+]* pattern, the postback path passed the submitted _handler value straight to the handler dispatcher with no such check, so any controller that exposes a public action or conditionally relaxes its $requiredPermissions check could be reached, bypassing the roles and permissions system. The built-in Users controller was affected because it set $requiredPermissions to null for the myaccount action, letting any authenticated backend user invoke user-management methods such as update_onDelete and update_onManualPasswordReset without holding the backend.manage_users permission. This issue is fixed in version 1.2.13.","status":"published","published":"2026-08-26T17:16:56.397Z","modified":"2026-09-09T21:09:13.08Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:12:41.66469Z"}],"osv":[{"id":"CVE-2026-35445","title":"Winter: Authenticated backend users can bypass Users controller permission checks","description":"Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback _handler POST field, allowing an authenticated backend user to invoke arbitrary controller methods, including protected, private, and action-prefixed ones. While AJAX requests validate that handler names match the on[A-Z][\\w+]* pattern, the postback path passed the submitted _handler value straight to the handler dispatcher with no such check, so any controller that exposes a public action or conditionally relaxes its $requiredPermissions check could be reached, bypassing the roles and permissions system. The built-in Users controller was affected because it set $requiredPermissions to null for the myaccount action, letting any authenticated backend user invoke user-management methods such as update_onDelete and update_onManualPasswordReset without holding the backend.manage_users permission. This issue is fixed in version 1.2.13.","status":"published","published":"2026-08-26T16:40:51.5Z","modified":"2026-10-28T02:30:48.246678732Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","level":"high"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:45:02.673625Z"},{"id":"GHSA-j5jq-cr68-v2xx","title":"Winter: Authenticated backend users can bypass Users controller permission checks","description":"### Impact\n\nAffected versions of Winter CMS did not validate the handler name submitted through the form postback mechanism (`_handler` POST field) in the same way as AJAX requests (`X_WINTER_REQUEST_HANDLER` header). The AJAX path validates that handler names match the `on[A-Z][\\w+]*` pattern, but the postback path passed the handler name directly to the handler dispatcher with no validation.\n\nThis allowed an authenticated backend user to call any method on a controller — including action-prefixed, protected, and private methods — by submitting a crafted POST request with a `_handler` field, as long as the controller either:\n\n- Contains a publicly available action via the `$publicActions` property, or\n- Degrades or removes the `$requiredPermissions` check in its constructor based on a condition\n\nThe backend's own Users controller was affected by the second scenario: it set `$requiredPermissions` to `null` for the `myaccount` action, allowing any authenticated backend user to access the controller without the `backend.manage_users` permission. Combined with the postback bypass, this allowed calling controller methods such as `update_onDelete`, `update_onRestore`, `update_onUnsuspendUser`, and `update_onManualPasswordReset` with attacker-controlled parameters.\n\nNote that CSRF tokens are still verified on all POST requests, so the attacker must be logged into the backend with a valid session.\n\nTo actively exploit this security issue, an attacker would need access to the Backend with a user account with any level of access.\n\nThe Winter CMS maintainers strongly recommend that all Winter CMS sites that have any reliance on the roles \u0026 permissions system to update immediately. Security fixes have been backported to all major versions of Winter (1.0, 1.1, and 1.2).\n\n### Patches\n\nThe postback handler path now validates handler names using the same rules as the AJAX path. The My Account functionality has been moved to a dedicated controller that does not expose user management methods. Defence in depth has been applied at the model level to prevent unauthorized user record modifications regardless of the entry point.\n\nThis security issue has been fixed as of v1.2.13.\n\n### Workarounds\n\nIf users cannot upgrade, they may apply the following changes to their Winter CMS installation manually to resolve this issue:\n\n1. In `modules/backend/classes/Controller.php`, validate the `_handler` POST field against the `on[A-Z][\\w+]*` pattern before passing it to `runAjaxHandler()`.\n2. In `modules/backend/controllers/Users.php`, remove the conditional that sets `$requiredPermissions` to `null` for the `myaccount` action.","status":"published","published":"2026-08-12T15:15:17Z","modified":"2026-08-12T15:41:04.337293Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","level":"high"}],"cwes":["CWE-285","CWE-639"],"updated_at":"2026-11-02T15:46:49.977351Z"}]}}