CVE-2026-32639

Name of the Vulnerable Software and Affected Versions Winter CMS versions prior to 1.2.13

Description Theme Editor AJAX handlers in the CMS section do not enforce per-template-type permission checks. While the CMS controller CmsControllersIndex uses OR-logic across five permissions (cms.manage pages, cms.manage partials, cms.manage layouts, cms.manage content, cms.manage assets) to grant access to the section, individual handlers such as onSave(), onDelete(), and onDeleteTemplates() fail to verify if the user possesses the specific permission for the requested template type. This allows an authenticated backend user with any single CMS permission to perform unauthorized actions, such as deleting layouts, modifying partials, or reading content files. Additionally, the AssetList widget is registered for any user passing the controller gate regardless of the cms.manage assets permission, and its onUpload() handler lacks the theme-validation call used by other mutating handlers, enabling unauthorized file uploads into the active theme's asset directory.

Recommendations Update to version 1.2.13. As a temporary workaround, in modules/cms/controllers/Index.php, wrap each widget registration in the constructor with the corresponding hasAccess() check and add a validateRequestType() call to the index onOpenTemplate(), onSave(), onCreateTemplate(), onDeleteTemplates(), onDelete(), onCommit(), and onReset() handlers to verify the user holds the permission for the requested template type. As a temporary workaround, in modules/cms/widgets/AssetList.php, add a $this->validateRequestTheme() call at the top of the onUpload() method.