Unauthorized Access Vulnerability in Winter CMS by Winter

CVE-2026-35445

What is CVE-2026-35445?

Winter CMS, a content management system built on the Laravel PHP framework, has a vulnerability that allows authenticated backend users to invoke arbitrary controller methods due to insufficient validation of the handler name in the _handler POST field. This oversight permits access to protected and private controller actions as well as methods that should be restricted by permissions. Specifically, the lack of validation facilitates the invocation of user-management actions by authenticated users, bypassing access controls. The vulnerability affects versions prior to 1.2.13 and has been addressed in the latest release.

References