{"vulnerability": "GHSA-FM29-4MQ3-PHG6", "sightings": [{"uuid": "63577f21-755a-4b0f-90fa-0ab4326c9ae8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-FM29-4MQ3-PHG6", "type": "seen", "source": "https://gist.github.com/alon710/35dc9a9f4fdde910b87a4f845467f8ee", "content": "# GHSA-FM29-4MQ3-PHG6: GHSA-FM29-4MQ3-PHG6: Missing Authorization in Winter CMS ImportExportController Behavior\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-08-20\n> **Full Report:** https://cvereports.com/reports/GHSA-FM29-4MQ3-PHG6\n\n## Summary\nWinter CMS contains an authorization bypass vulnerability within its ImportExportController behavior. Due to a design flaw in the request lifecycle processing, permissions configured for data import and export operations are not validated during AJAX-based requests, allowing authenticated users with limited privileges to perform unauthorized data exfiltration or database manipulation.\n\n## TL;DR\nAn authorization bypass in Winter CMS prior to 1.2.14 allows authenticated backend users with basic controller access to bypass granular import/export permission gates by interacting directly with AJAX handlers.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862 (Missing Authorization)\n- **Attack Vector**: Network (Unauthenticated or low-privilege backend session required)\n- **CVSS v3.1 Score**: 8.1 (High)\n- **Impact**: Privilege Escalation, Unauthorized Data Exfiltration, Database Manipulation\n- **Exploit Status**: PoC / Regression Test validation\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Winter CMS instances utilizing the Backend module and implementing the ImportExportController behavior in custom components.\n- **Winter CMS**: >= 1.0.0, < 1.2.14 (Fixed in: `1.2.14`)\n\n## Mitigation\n\n- Upgrade the Winter CMS installation to version 1.2.14 or higher to resolve the lifecycle authorization flaw.\n- In corporate environments where patching is delayed, apply the code diff manually to guard the AJAX entry points inside modules/backend/behaviors/ImportExportController.php.\n- Configure WAF rules to intercept AJAX post-backs requesting onExport or onImport handlers from unprivileged backend users.\n\n**Remediation Steps:**\n1. Execute 'composer update winter/storm winter/cms' within the deployment root to transition to the patched release.\n2. Verify the application of the patch by checking modules/backend/behaviors/ImportExportController.php for the added 'userHasAccess' validations.\n3. Execute the provided regression test suite using phpunit to ensure GatedImportExportController properly returns HTTP 403 when permissions are missing.\n\n## References\n\n- [GHSA-FM29-4MQ3-PHG6 Security Advisory](https://github.com/advisories/GHSA-FM29-4MQ3-PHG6)\n- [Fix Commit 84c81f153f2dc3e](https://github.com/wintercms/winter/commit/84c81f153f2dc3e2c7b03ab14a4a3ca8456d0e4f)\n- [Winter CMS v1.2.14 Release Notes](https://github.com/wintercms/winter/releases/tag/v1.2.14)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-FM29-4MQ3-PHG6) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-21T11:33:52.582366Z"}]}