DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

GHSA-FM29-4MQ3-PHG6: GHSA-FM29-4MQ3-PHG6: Missing Authorization in Winter CMS ImportExportController Behavior

#security #cve #cybersecurity #ghsa

GHSA-FM29-4MQ3-PHG6: Missing Authorization in Winter CMS ImportExportController Behavior

Vulnerability ID: GHSA-FM29-4MQ3-PHG6
CVSS Score: 8.1
Published: 2026-08-20

Winter CMS contains an authorization bypass vulnerability within its ImportExportController behavior. Due to a design flaw in the request lifecycle processing, permissions configured for data import and export operations are not validated during AJAX-based requests, allowing authenticated users with limited privileges to perform unauthorized data exfiltration or database manipulation.

TL;DR

An authorization bypass in Winter CMS prior to 1.2.14 allows authenticated backend users with basic controller access to bypass granular import/export permission gates by interacting directly with AJAX handlers.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-862 (Missing Authorization)
  • Attack Vector: Network (Unauthenticated or low-privilege backend session required)
  • CVSS v3.1 Score: 8.1 (High)
  • Impact: Privilege Escalation, Unauthorized Data Exfiltration, Database Manipulation
  • Exploit Status: PoC / Regression Test validation
  • CISA KEV Status: Not Listed

Affected Systems

  • Winter CMS instances utilizing the Backend module and implementing the ImportExportController behavior in custom components.
  • Winter CMS: >= 1.0.0, < 1.2.14 (Fixed in: 1.2.14)

Code Analysis

Commit: 84c81f1

Fix authorization bypass in ImportExportController behavior by adding userHasAccess checks into AJAX handler entry points.

--- a/modules/backend/behaviors/ImportExportController.php
+++ b/modules/backend/behaviors/ImportExportController.php
@@ -181,6 +184,10 @@ public function export()

     public function download($name, $outputName = null)
     {
+        if (!$this->userHasAccess('export')) {
+            abort(403);
+        }
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade the Winter CMS installation to version 1.2.14 or higher to resolve the lifecycle authorization flaw.
  • In corporate environments where patching is delayed, apply the code diff manually to guard the AJAX entry points inside modules/backend/behaviors/ImportExportController.php.
  • Configure WAF rules to intercept AJAX post-backs requesting onExport or onImport handlers from unprivileged backend users.

Remediation Steps:

  1. Execute 'composer update winter/storm winter/cms' within the deployment root to transition to the patched release.
  2. Verify the application of the patch by checking modules/backend/behaviors/ImportExportController.php for the added 'userHasAccess' validations.
  3. Execute the provided regression test suite using phpunit to ensure GatedImportExportController properly returns HTTP 403 when permissions are missing.

References

Read the full report for GHSA-FM29-4MQ3-PHG6 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)