go-wind-cms EUVD-2026-67324

Exploitation requires possession of at least one valid authenticated session on the target go-wind-cms instance - the account's assigned role and tenant membership are irrelevant because the authorization check is unconditionally bypassed. The attacker must have network access to the application's API layer. The flaw is present in the default code path and does not require any non-standard configuration to trigger. What limits exploitation: (1) the attacker must hold a valid account (PR:L per CVSS vector), meaning entirely unauthenticated external attackers cannot exploit this directly; (2) if the application restricts self-registration, the attacker must obtain credentials through another means (phishing, credential stuffing, or an insider). There are no platform-specific, OS-specific, or feature-toggle prerequisites - any deployment of go-wind-cms before 1.0.0 is vulnerable by default.

The CVSS 8.8 score is consistent with the described impact: network-reachable (AV:N), low complexity (AC:L), low-privilege authentication required (PR:L), no user interaction (UI:N), and full confidentiality, integrity, and availability impact. The real-world risk is meaningfully elevated by the existence of a publicly available proof-of-concept, which lowers the technical bar for exploitation substantially. However, the PR:L requirement means unauthenticated access is not sufficient - an attacker must first obtain any valid account on the target instance. No CISA KEV listing is present, and EPSS data was not provided in the input, so exploitation probability cannot be quantitatively benchmarked. The scope is unchanged (S:U), confining blast radius to the vulnerable CMS instance. For multi-tenant deployments or applications where user account self-registration is permitted, the practical barrier to reaching a low-privilege session is minimal, making the effective risk closer to the theoretical maximum. For tightly controlled single-tenant deployments, the requirement for a valid session provides some real-world friction.

An attacker registers or otherwise obtains any valid low-privilege account on a go-wind-cms instance, then directly invokes an administrative API endpoint - such as the user deletion or password reset route - with a standard authenticated HTTP request. Because NewAuthorizer() returns noop.State{}, the authz middleware approves the request without evaluating the caller's role, and the server executes the privileged operation. A publicly available proof-of-concept at https://github.com/TKar0/TKar0-CvePoc/tree/main/2026-CVE-POC/CVE-2026-75419 demonstrates this attack path.