CVE-2026-125339

Name of the Vulnerable Software and Affected Versions Winter CMS versions 1.0.319 through 1.2.13

Description An issue exists where the BackendClassesController::actionExists() function accepts public handler-shaped methods as page actions. This allows a top-level GET request to invoke state-changing backend AJAX handlers without a CSRF (Cross-Site Request Forgery) token. Because backend routes use Route::any and CSRF validation is skipped for GET requests, an unauthenticated attacker can induce an authorized backend user to follow a malicious link. This can lead to destructive actions such as truncating logs, resetting settings, altering backend user state, or deleting CMS templates. The attacker can also select target records via URL path segments. The default SameSite=Lax session cookie facilitates this by being sent during cross-site navigation.

Recommendations Update to version 1.2.14. As an interim mitigation, set 'same site' => 'strict' in config/session.php to prevent session cookies from being sent during cross-site top-level navigation.