Winter CMS CVE-2026-35445

Exploitation requires an active, authenticated Winter CMS backend session-any permission level suffices, but the attacker must hold a valid CSRF token (enforced on all POST requests, meaning purely unauthenticated exploitation is not possible). The specific escalation path through the Users controller requires that controller to be configured with the default conditional $requiredPermissions = null for the myaccount action, which is present in affected versions by default and not a non-standard configuration. The broader handler-bypass vulnerability (CWE-285) affects any controller that exposes $publicActions or conditionally removes its permission check, so other attack surfaces may exist beyond the Users controller depending on installed plugins. Exploitation is limited to the backend panel; it does not extend to unauthenticated visitors of the public-facing site. The CSRF requirement limits drive-by or cross-site exploitation-the attacker must be actively logged in with a valid session cookie.

The provided CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N) reflects network-reachable exploitation by a low-privilege authenticated user, with a notable attack requirement (AT:P) acknowledging that the controller's conditional permission nullification must be in place-which it is by default in the Users controller. The high confidentiality impact (VC:H, SC:H) and scope change to subsequent systems are consistent with an attacker being able to reset arbitrary user passwords and thereby escalate to full admin access. The vendor's own advisory rates integrity impact as lower (VI:L, SI:L), but the ability to delete or unsuspend user accounts warrants reconsideration of that rating. There is no CISA KEV listing and no reported POC, making opportunistic mass exploitation unlikely; however, the low attack complexity and minimal access requirement (any backend account) make insider-threat and post-compromise lateral-privilege scenarios credible. EPSS data was not provided. Real-world priority is moderate-to-high for any Winter CMS deployment that exposes its backend panel to untrusted authenticated users or relies on its roles-and-permissions system for separation of duty.

An attacker with any Winter CMS backend account-such as a low-privilege editor-crafts a POST request to a backend URL that loads the Users controller under the myaccount action (which carries a null permission requirement by default), and sets the _handler field to update_onDelete or update_onManualPasswordReset along with attacker-controlled parameters identifying a target user. Because the postback path does not validate the handler name, the request reaches the privileged method; the attacker can thereby delete, unsuspend, or reset the password of any backend user, including administrators, enabling full privilege escalation within the backend. No public exploit code has been identified at time of analysis.