CVE-2026-35445

Name of the Vulnerable Software and Affected Versions Winter CMS versions prior to 1.2.13

Description An issue exists where the backend fails to validate the handler name submitted via the handler POST field during form postbacks. While AJAX requests are validated against the on[A-Z][w+]* pattern, the postback path passes the handler value directly to the handler dispatcher without validation. This allows an authenticated backend user to invoke arbitrary controller methods, including protected, private, and action-prefixed ones, provided the controller has a public action or relaxes its $requiredPermissions check. For instance, the Users controller set $requiredPermissions to null for the myaccount action, enabling users without the backend.manage users permission to call sensitive methods such as update onDelete and update onManualPasswordReset().

Recommendations Update Winter CMS to version 1.2.13 or later. As a temporary workaround, validate the handler POST field against the on[A-Z][w+]* pattern in modules/backend/classes/Controller.php before it is passed to runAjaxHandler(). As a temporary workaround, remove the conditional that sets $requiredPermissions to null for the myaccount action in modules/backend/controllers/Users.php.