Unauthorized Access in Winter CMS Theme Editor by Winter

CVE-2026-32639

What is CVE-2026-32639?

Winter CMS, a content management system based on the Laravel PHP framework, suffers from an access control vulnerability in its Theme Editor. In versions up to and including 1.2.12, the theme editor's AJAX handlers failed to enforce permission checks appropriately, allowing backend users to manipulate template types beyond their granted permissions. This flaw permits users with limited CMS permissions to perform unauthorized actions such as deleting layouts, modifying partials, and accessing sensitive content files. Additionally, the AssetList widget did not restrict uploads based on permissions, enabling unauthorized file uploads to the theme's asset directory. The issue was resolved in version 1.2.13.

References