GHSA-mpmw-f6h6-3g26: Insecure Direct Object Reference in Winter CMS My Account Controller
Vulnerability ID: GHSA-MPMW-F6H6-3G26
CVSS Score: 4.3
Published: 2026-08-20
An Insecure Direct Object Reference (IDOR) vulnerability was identified in Winter CMS version 1.2.13. The vulnerability exists within the newly introduced Backend\Controllers\MyAccount controller, which utilizes the FormController behavior without appropriate model query scoping or routing controls. This allows authenticated, low-privilege backend users to retrieve sensitive personal and administrative data of other backend accounts by enumerating record identifiers via standard CRUD routes.
TL;DR
In Winter CMS 1.2.13, low-privilege backend users can access other users' full profile details, including emails, usernames, and administrative roles, due to an unscoped FormController query combined with unrouted CRUD endpoints in the My Account controller.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-639
- Attack Vector: Network (AV:N)
- Privileges Required: Low (PR:L)
- Exploit Status: Proof of Concept Available
- CISA KEV Status: Not Listed
- Vulnerability Class: Insecure Direct Object Reference
Affected Systems
- Winter CMS backend module (winter/wn-backend-module)
-
winter/wn-backend-module: == 1.2.13 (Fixed in:
1.2.14)
Mitigation Strategies
- Upgrade the winter/wn-backend-module dependency to v1.2.14 or later.
- Manually override the MyAccount controller to implement endpoint guarding and query scoping if immediate upgrade is not possible.
Remediation Steps:
- Navigate to the project root directory.
- Execute the package manager command:
composer update winter/wn-backend-module. - Verify that the local installation of
modules/backend/controllers/MyAccount.phpcontains the$guardedarray and theformExtendQuerymethod.
Read the full report for GHSA-MPMW-F6H6-3G26 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)