{"uuid": "2619e7f2-733f-4857-b828-2d955443982f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-MPMW-F6H6-3G26", "type": "seen", "source": "https://gist.github.com/alon710/67db9159d1345bdc7ca8782a080ca880", "content": "# GHSA-MPMW-F6H6-3G26: GHSA-mpmw-f6h6-3g26: Insecure Direct Object Reference in Winter CMS My Account Controller\n\n> **CVSS Score:** 4.3\n> **Published:** 2026-08-20\n> **Full Report:** https://cvereports.com/reports/GHSA-MPMW-F6H6-3G26\n\n## Summary\nAn Insecure Direct Object Reference (IDOR) vulnerability was identified in Winter CMS version 1.2.13. The vulnerability exists within the newly introduced Backend\\Controllers\\MyAccount controller, which utilizes the FormController behavior without appropriate model query scoping or routing controls. This allows authenticated, low-privilege backend users to retrieve sensitive personal and administrative data of other backend accounts by enumerating record identifiers via standard CRUD routes.\n\n## TL;DR\nIn Winter CMS 1.2.13, low-privilege backend users can access other users' full profile details, including emails, usernames, and administrative roles, due to an unscoped FormController query combined with unrouted CRUD endpoints in the My Account controller.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-639\n- **Attack Vector**: Network (AV:N)\n- **Privileges Required**: Low (PR:L)\n- **Exploit Status**: Proof of Concept Available\n- **CISA KEV Status**: Not Listed\n- **Vulnerability Class**: Insecure Direct Object Reference\n\n## Affected Systems\n\n- Winter CMS backend module (winter/wn-backend-module)\n- **winter/wn-backend-module**: == 1.2.13 (Fixed in: `1.2.14`)\n\n## Mitigation\n\n- Upgrade the winter/wn-backend-module dependency to v1.2.14 or later.\n- Manually override the MyAccount controller to implement endpoint guarding and query scoping if immediate upgrade is not possible.\n\n**Remediation Steps:**\n1. Navigate to the project root directory.\n2. Execute the package manager command: `composer update winter/wn-backend-module`.\n3. Verify that the local installation of `modules/backend/controllers/MyAccount.php` contains the `$guarded` array and the `formExtendQuery` method.\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-MPMW-F6H6-3G26) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-21T12:31:52.297527Z"}