{"id":"CVE-2026-35445","title":"Winter CMS is a content management system built on the Laravel PHP framework","summary":"Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback _handler POST field, allowing an authenticated b…","severity":"high","cwe":["CWE-285","CWE-639"],"vendor":"winter","product":"winter/wn-backend-module","affected":["winter/wn-backend-module <= 1.2.12"],"patched":["winter/wn-backend-module 1.2.13"],"published":"2026-08-26","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:09:13.080","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35445","references":[{"url":"https://github.com/wintercms/winter/pull/1473","label":"security-advisories@github.com"},{"url":"https://github.com/wintercms/winter/releases/tag/v1.2.13","label":"security-advisories@github.com"},{"url":"https://github.com/wintercms/winter/security/advisories/GHSA-j5jq-cr68-v2xx","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-j5jq-cr68-v2xx"}],"tags":["nvd","ghsa","composer"],"epss":0.00253,"epssPercentile":0.17004,"aliases":["GHSA-j5jq-cr68-v2xx"],"ecosystem":"composer","ingestedAt":"2026-08-12T15:53:06.196Z","slug":"CVE-2026-35445","body":"## Overview\n\nWinter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback _handler POST field, allowing an authenticated backend user to invoke arbitrary controller methods, including protected, private, and action-prefixed ones. While AJAX requests validate that handler names match the on[A-Z][\\w+]* pattern, the postback path passed the submitted _handler value straight to the handler dispatcher with no such check, so any controller that exposes a public action or conditionally relaxes its $requiredPermissions check could be reached, bypassing the roles and permissions system. The built-in Users controller was affected because it set $requiredPermissions to null for the myaccount action, letting any authenticated backend user invoke user-management methods such as update_onDelete and update_onManualPasswordReset without holding the backend.manage_users permission. This issue is fixed in version 1.2.13.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-35445)\n\nAffected packages:\n\n- `winter/wn-backend-module <= 1.2.12`\n\nPatched in:\n\n- `winter/wn-backend-module 1.2.13`\n\nSource: https://github.com/advisories/GHSA-j5jq-cr68-v2xx","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}