{"answers":{"affected":"2 open source packages ship an affected version, including winter/wn-cms-module.","exploited":"There is no known exploitation of CVE-2026-32639 in the wild and no public exploit code.","fix":"Upgrade winter/wn-cms-module to 1.2.13 or later.","what":"CVE-2026-32639 is a medium-severity missing authorization vulnerability in wintercms winter, published on 26 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-32639 and fix it if it is affected.\n\nWhat it is: CVE-2026-32639 is a medium-severity missing authorization vulnerability in wintercms winter, published on 26 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-32639 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- winter/wn-cms-module (Packagist): affected all versions; fixed in 1.2.13\n- winter/wn-cms-module (Packagist): affected all versions; fixed in 1.2.13\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-32639/ (Markdown: https://insights.sbomify.com/CVE-2026-32639/index.md)","id":"CVE-2026-32639","markdown":"https://insights.sbomify.com/CVE-2026-32639/index.md","name":"CVE-2026-32639","record":{"aliases":["GHSA-5c4f-9pq9-6c77"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["data_modify","data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Winter CMS","requires_auth":"high_privilege","summary":"Authenticated backend users with limited CMS permissions can bypass authorization checks to modify unauthorized templates and upload files.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":6.8,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-289","name":"Authentication Bypass by Alternate Name"}],"description":"Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Theme Editor AJAX handlers did not enforce per-template-type permission checks, allowing a backend user with any single CMS permission to act on template types outside their authorized scope. The CMS controller gated access to the section as a whole using OR-logic across its five permissions, but individual handlers such as onSave(), onDelete(), and onDeleteTemplates() did not verify that the user held the specific permission for the requested template type, so a user with only cms.manage_pages could craft AJAX requests to delete layouts, modify partials, or read content files. Separately, the AssetList widget was registered for any user who passed the controller gate regardless of the cms.manage_assets permission, and its onUpload() handler omitted the theme-validation call present on the other mutating handlers, permitting unauthorized file uploads into the active theme's asset directory. Exploitation requires an authenticated backend account holding at least one of the CMS Theme Editor permissions. This issue is fixed in version 1.2.13.","ecosystems":["Packagist"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Winter: Broken access control in `Cms\\Controllers\\Index` allows cross-template actions and unauthorized asset uploads","id":"CVE-2026-32639","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":2,"n_references":4,"next":{"headline":"(SimpleEval) Objects (including modules) can leak dangerous modules through to direct access inside the sandbox.","id":"CVE-2026-32640"},"packages":[{"ecosystem":"Packagist","fixed":["1.2.13"],"introduced":["0"],"last_affected":[],"package":"winter/wn-cms-module","purl":null,"source":"GHSA-5c4f-9pq9-6c77"},{"ecosystem":"Packagist","fixed":["1.2.13"],"introduced":["0"],"last_affected":[],"package":"winter/wn-cms-module","purl":"pkg:composer/winter/wn-cms-module","source":"GHSA-5c4f-9pq9-6c77"}],"prev":{"headline":"StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens","id":"CVE-2026-32638"},"products":["winter"],"published":"2026-08-26","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-29","vendors":["wintercms"]},"summary":"Authenticated backend users with limited CMS permissions can bypass authorization checks to modify unauthorized templates and upload files.","url":"https://insights.sbomify.com/CVE-2026-32639/"}