CVE-2026-27591
CRITICAL
GHSA-pgpf-m8m4-6cg6
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3Description
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.0.477, 1.1.12, and 1.2.12, Winter CMS allowed authenticated backend users to escalate their accounts level of access to the system by modifying the roles / permissions assigned to their account through specially crafted requests to the backend while logged in. To actively exploit this security issue, an attacker would need access to the Backend with a user account with any level of access. This vulnerability is fixed in 1.0.477, 1.1.12, and 1.2.12.
Analysis
Access control bypass in Winter CMS before 1.0.477/1.1.12/1.2.12. CVSS 9.9.
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Identify all systems running Winter CMS and assess exposure; isolate critical instances if possible and enable enhanced monitoring. Within 7 days: Implement compensating controls (WAF rules, network segmentation, disable vulnerable features); establish incident response procedures. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today