Winter CMS: Missing authorization in ImportExportController AJAX handlers
Summary
Winter CMS, a Laravel-based content management system, allows backend users to bypass granular import and export permissions in the ImportExportController behavior. An authenticated backend user with general access to a controller, but without the configured import or export permissions, can call import handlers to write or overwrite records and can export and download the complete dataset. Controllers without granular permission keys are not affected.
Affected
- Winter CMS (winter/wn-backend-module) before 1.2.14
- Affected version range is disputed among sources (some state from 1.0.0 or 1.2.0); treat all versions below 1.2.14 as affected
- Only controllers that configure import[permissions] or export[permissions]
Fixed in
- Version 1.2.14 (granular import/export permission checks enforced on all affected handlers and actions)
Workaround
- No vendor-documented workaround.
- Interim measure: review which backend roles can reach controllers with import or export permissions and remove unneeded access until the upgrade is complete.
Exploitation
- Requires a valid backend account with a session; not unauthenticated.
- OffSeq lists it as not known to be exploited as of 10 November 2026.
- No public proof of concept found. CISA SSVC: exploitation none, automatable no, technical impact total.
- Unknown whether the CISA KEV catalogue lists it; verify manually.
Our recommendation
- Upgrade Winter CMS to version 1.2.14 or later; the same release also covers CVE-2026-125338, CVE-2026-125339 and CVE-2026-126061.
- Review backend user roles and remove unneeded access to controllers with import or export permissions.
- Check whether backends are reachable from the internet and restrict access to the /backend login where possible.
- Monitor backend logs for unusual import, export or download activity.
- Verify the CVSS score, as sources differ (CNA 8.3, Mend 5.4).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-fm29-4mq3-phg6 github.com
- Fix commit 84c81f1 github.com
- Winter CMS v1.2.14 release github.com
- OSV GHSA-fm29-4mq3-phg6 osv.dev
- GitLab advisory GHSA-fm29-4mq3-phg6 advisories.gitlab.com
- CVE record summary (threatint) cve.threatint.com
- OffSeq threat radar CVE-2026-125337 radar.offseq.com
- Mend advisory MEND:WS-2026-0042 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:18.
Original description (NVD)
Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, the ImportExportController behavior applies userHasAccess() only to the import() and export() page actions, while Backend\Classes\Controller::execAjaxHandlers() dispatches onImport(), onImportLoadForm(), onImportLoadColumnSampleForm(), onExport(), and onExportLoadForm() before those gated actions run, and the separately reachable download() action also lacks the granular export check. An authenticated backend user with a valid session and coarse access through $requiredPermissions, but without the configured import[permissions] or export[permissions], can use the import handlers to write or overwrite records and can use onExport() followed by download() to retrieve the complete dataset exposed by the export model. Controllers without granular permission keys are unaffected because userHasAccess() is intentionally default-permissive. This issue is fixed in version 1.2.14.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.