CVE-2026-35445
- Source
- https://cve.org/CVERecord?id=CVE-2026-35445
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35445.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-35445
- Aliases
- Published
- 2026-08-26T16:40:51.500Z
- Modified
- 2026-08-28T11:47:24.813633078Z
- Severity
-
- 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N CVSS Calculator
- Summary
- Winter: Authenticated backend users can bypass Users controller permission checks
- Details
-
Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback handler POST field, allowing an authenticated backend user to invoke arbitrary controller methods, including protected, private, and action-prefixed ones. While AJAX requests validate that handler names match the on[A-Z][\w+]* pattern, the postback path passed the submitted handler value straight to the handler dispatcher with no such check, so any controller that exposes a public action or conditionally relaxes its $requiredPermissions check could be reached, bypassing the roles and permissions system. The built-in Users controller was affected because it set $requiredPermissions to null for the myaccount action, letting any authenticated backend user invoke user-management methods such as updateonDelete and updateonManualPasswordReset without holding the backend.manage_users permission. This issue is fixed in version 1.2.13.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35445.json", "cwe_ids": [ "CWE-285" ], "cna_assigner": "GitHub_M" }- References
-
- https://github.com/wintercms/winter/releases/tag/v1.2.13
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35445.json
- https://github.com/wintercms/winter/security/advisories/GHSA-j5jq-cr68-v2xx
- https://nvd.nist.gov/vuln/detail/CVE-2026-35445
- https://github.com/wintercms/winter/pull/1473