Auth bypass in Wintercms Winter
CVE-2026-126061
Winter CMS is a content management system built on the Laravel PHP framework. From 1.2.13 until 1.2.14, the Backend\Controllers\MyAccount controller inherits the FormController actions create, update, and preview while declaring an empty $requiredPermissions array, and formFindModelObject() resolves a caller-supplied record identifier through an unscoped Backend\Models\User query. Any authenticated backend user can request another sequential user identifier through /backend/backend/myaccount/preview/{other_user_id} or the inherited update action and read profile data including name, login, email, avatar, role, group membership, superuser status, and throttle state. Password material is not exposed, and existing model authorization guards block cross-user writes. This issue is fixed in version 1.2.14.
Vulnerability class: IDOR (Insecure Direct Object Reference)
Published .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Wintercms Winter — versions >= 1.2.13, < 1.2.14
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-126061?
- CVE-2026-126061 is a medium-severity vulnerability in Wintercms Winter, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.3/10. Published 2026-11-10.
- How severe is CVE-2026-126061?
- Medium severity. CVSS v3 base score is 4.3 out of 10.