WinterCMS Winter up to 1.2.12 Theme Editor AJAX handlers/AssetList widget onSave/onDelete/onDeleteTemplates/onUpload privileges management

Summaryinfo

A vulnerability labeled as problematic has been found in WinterCMS Winter up to 1.2.12. This issue affects the function onSave/onDelete/onDeleteTemplates/onUpload of the component Theme Editor AJAX handlers/AssetList widget. The manipulation results in privileges management. This vulnerability is identified as CVE-2026-32639. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in WinterCMS Winter up to 1.2.12. It has been classified as problematic. Affected is the function onSave/onDelete/onDeleteTemplates/onUpload of the component Theme Editor AJAX handlers/AssetList widget. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality. CVE summarizes:

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Theme Editor AJAX handlers did not enforce per-template-type permission checks, allowing a backend user with any single CMS permission to act on template types outside their authorized scope. The CMS controller gated access to the section as a whole using OR-logic across its five permissions, but individual handlers such as onSave(), onDelete(), and onDeleteTemplates() did not verify that the user held the specific permission for the requested template type, so a user with only cms.manage_pages could craft AJAX requests to delete layouts, modify partials, or read content files. Separately, the AssetList widget was registered for any user who passed the controller gate regardless of the cms.manage_assets permission, and its onUpload() handler omitted the theme-validation call present on the other mutating handlers, permitting unauthorized file uploads into the active theme's asset directory. Exploitation requires an authenticated backend account holding at least one of the CMS Theme Editor permissions. This issue is fixed in version 1.2.13.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-32639 since 03/12/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 1.2.13 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• WinterCMS

Name

• Winter

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6
• 1.2.7
• 1.2.8
• 1.2.9
• 1.2.10
• 1.2.11
• 1.2.12

Website

• Product: https://github.com/wintercms/winter/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion