CVE-2026-126061

Name of the Vulnerable Software and Affected Versions Winter CMS versions 1.2.13 through 1.2.13

Description An authenticated backend user can cause unauthorized disclosure of other backend user profile data. The BackendControllersMyAccount controller inherits actions from FormController while declaring an empty $requiredPermissions array, and the formFindModelObject() function resolves record identifiers through an unscoped BackendModelsUser query. This allows an attacker to request sequential user identifiers via the /backend/backend/myaccount/preview/{other user id} endpoint or the inherited update action to read sensitive information, including name, login, email, avatar, role, group membership, superuser status, and throttle state. Password material is not exposed, and cross-user writes are blocked by authorization guards.

Recommendations Update Winter CMS to version 1.2.14. As a temporary workaround, add protected $guarded = ['create','update','preview']; to the BackendControllersMyAccount controller and implement a formExtendQuery() method to scope lookups to the current user's key.