CVE-2026-32639: Winter CMS Theme Editor Auth Bypass Flaw

CVE-2026-32639 Overview

Winter CMS, a content management system built on the Laravel PHP framework, contains a broken access control vulnerability in versions up to and including 1.2.12. The CMS section's Theme Editor AJAX handlers fail to enforce per-template-type permission checks. A backend user holding any single CMS Theme Editor permission can act on template types outside their authorized scope. The controller gates access to the section using OR-logic across five permissions, but individual handlers such as onSave(), onDelete(), and onDeleteTemplates() skip verification of the specific permission tied to the requested template type. The issue is fixed in version 1.2.13.

Critical Impact
An authenticated backend user with only cms.manage_pages can delete layouts, modify partials, read content files, and upload arbitrary files to the active theme's asset directory.

Affected Products

Winter CMS versions up to and including 1.2.12
Winter CMS cms module (Theme Editor / Index controller)
Winter CMS AssetList widget (onUpload() handler)

Discovery Timeline

2026-08-26 - CVE-2026-32639 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-32639

Vulnerability Analysis

The CMS Theme Editor exposes five distinct permissions covering pages, partials, layouts, content, and assets. The Index controller in modules/cms/controllers/Index.php gates entry to the section using OR-logic across these permissions. Once a user passes that gate, downstream AJAX handlers assume authorization for all template types. This design flaw maps to [CWE-289: Authentication Bypass by Alternate Name], allowing a low-scope backend account to perform mutating actions across template types the account should not touch.

A parallel weakness affects the AssetList widget. The widget is registered for any user who passes the controller gate, regardless of whether the account holds cms.manage_assets. Additionally, onUpload() omits the theme-validation call present on other mutating handlers, allowing file writes into the active theme's asset directory without theme-scope enforcement.

Root Cause

Authorization is enforced at the controller boundary but not at the handler boundary. Handlers like onSave(), onDelete(), and onDeleteTemplates() accept a template $type parameter from the request without confirming the caller holds the corresponding permission. The makeTemplateFormWidget() method builds form widgets for any requested type without validating it. Similarly, AssetList::onUpload() does not invoke validateRequestTheme(), breaking the theme-scoping contract used by sibling handlers.

Attack Vector

Exploitation requires an authenticated backend account holding at least one of the five CMS Theme Editor permissions. The attacker crafts AJAX requests to the Index controller specifying template types outside their authorized scope, or POSTs a file to the AssetList upload handler. Because the CVSS scope is Changed, the impact reaches assets the vulnerable component was not authorized to control.

php

// Patch: modules/cms/controllers/Index.php
// Adds per-type validation before building the form widget
protected function makeTemplateFormWidget(string $type, CmsObject|Asset $template, ?string $alias = null): Form
{
+   $this->validateRequestType($type);
+
    $formConfigs = [
        'page'    => '~/modules/cms/classes/page/fields.yaml',
        'partial' => '~/modules/cms/classes/partial/fields.yaml',
        // ...
    ];
}

// Patch: modules/cms/widgets/AssetList.php
// Adds missing theme validation on upload
public function onUpload()
{
+   $this->validateRequestTheme();
+
    $fileName = null;
    try {
        // ...
    }
}

Source: GitHub Commit 5391afa242eb and GitHub Commit 164c62524e8a

Detection Methods for CVE-2026-32639

Indicators of Compromise

Unexpected POST requests to /backend/cms/index/onSave, /onDelete, or /onDeleteTemplates with a type parameter that does not match the caller's assigned Theme Editor permission.
Backend user activity where a single-permission account interacts with multiple template types (pages, partials, layouts, content) within a short window.
New or modified files in the active theme's assets/ directory attributed to accounts lacking cms.manage_assets.
AJAX calls to AssetListonUpload from users whose role does not include the assets permission.

Detection Strategies

Correlate backend user role permissions against the type field observed in Theme Editor AJAX requests to flag scope violations.
Enable Winter CMS backend audit logging and alert on template deletions or asset uploads by low-privilege accounts.
Deploy web application firewall rules that inspect the type parameter on CMS AJAX endpoints and match it against session role claims.

Monitoring Recommendations

Monitor file system changes under themes/<active-theme>/assets/, pages/, partials/, layouts/, and content/ directories.
Track backend session activity for permission-role mismatches and log all onSave, onDelete, and onUpload handler invocations with the acting user identity.
Review Winter CMS version strings across managed installations to identify hosts running 1.2.12 or earlier.

How to Mitigate CVE-2026-32639

Immediate Actions Required

Upgrade Winter CMS to version 1.2.13 or later on all affected instances.
Audit backend user accounts and remove Theme Editor permissions from accounts that do not require them.
Review the active theme's asset, page, partial, layout, and content directories for unauthorized additions or modifications.
Rotate credentials for any backend accounts suspected of misuse during the exposure window.

Patch Information

The fix ships in Winter CMS 1.2.13. Two commits introduce the corrections: 5391afa242eb adds validateRequestType($type) to makeTemplateFormWidget() in modules/cms/controllers/Index.php, and 164c62524e8a adds validateRequestTheme() to AssetList::onUpload() and tightens widget registration against cms.manage_assets. Details are in the GitHub Security Advisory GHSA-5c4f-9pq9-6c77 and the GitHub Release v1.2.13.

Workarounds

Restrict backend access so only fully trusted administrators hold any CMS Theme Editor permission until the upgrade is applied.
Place the /backend path behind additional network controls such as VPN or IP allowlisting to reduce reachability.
Disable or unassign the five cms.manage_* permissions from lower-privilege roles as a temporary compensating control.

bash

# Upgrade Winter CMS via Composer
composer require wintercms/winter:^1.2.13
php artisan winter:up
php artisan cache:clear