CVE-2026-75419: GoWind CMS Auth Bypass Vulnerability

CVE-2026-75419 Overview

CVE-2026-75419 is a missing authorization vulnerability in go-wind-cms (GoWind) versions before 1.0.0. The NewAuthorizer() function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine (noop.State{}). As a result, the authz middleware permits every request that carries valid authentication. Any authenticated user can invoke administrative APIs regardless of role or tenant boundary.

Critical Impact

Authenticated low-privilege users can delete user accounts, reset passwords, and create tenants across the platform.

Affected Products

• go-wind-cms (GoWind) versions before 1.0.0
• Admin service component (app/admin/service)
• Application service component (app/app/service)

Discovery Timeline

• 2026-08-28 - CVE-2026-75419 published to NVD
• 2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-75419

Vulnerability Analysis

The flaw is a Broken Access Control condition tied to how go-wind-cms initializes its authorization layer. The NewAuthorizer() constructors in both the admin service and application service return noop.State{}, a placeholder implementation that approves every request. The authz middleware relies on this state object to enforce role and tenant checks. Because the placeholder returns an unconditional allow, the middleware performs no enforcement at runtime.

An attacker only needs valid authentication to reach administrative endpoints. Role membership, tenant scope, and object ownership are never evaluated. This maps to [CWE-113] as tracked by NVD, though the underlying weakness is authorization bypass through a missing enforcement policy.

Root Cause

The root cause is a wiring defect between the authorization engine and the middleware that consumes it. Developers left the no-op stub in place instead of registering a functional policy engine such as Casbin or an equivalent RBAC provider. The middleware trusts the engine's verdict without a fallback check, so the deny path is unreachable in production builds.

Attack Vector

Exploitation requires network access to the API and any valid authenticated session. An attacker authenticates with a normal, low-privilege account and then issues HTTP requests directly to administrative routes. Sensitive operations exposed include deleting users, resetting passwords, and creating tenants. See the GitHub PoC for CVE-2026-75419 and the GitHub Issue Discussion on CMS for reproduction steps.

No verified exploitation code is reproduced here. The proof of concept demonstrates that a standard authenticated HTTP request to an admin endpoint succeeds without any elevated role claim.

Detection Methods for CVE-2026-75419

Indicators of Compromise

• HTTP requests from non-administrative accounts hitting admin routes such as user deletion, password reset, or tenant creation endpoints.
• Sudden creation of new tenants or administrative users outside change-management windows.
• Password reset events for privileged accounts initiated by unrelated user sessions.

Detection Strategies

• Inspect application access logs for cross-tenant activity where the acting user's tenant identifier does not match the target resource's tenant.
• Correlate authentication events with administrative API calls to flag low-privilege principals invoking privileged handlers.
• Static-review deployed binaries or source for calls to NewAuthorizer() returning noop.State{}.

Monitoring Recommendations

• Enable verbose audit logging on all admin service endpoints and forward events to a central SIEM.
• Baseline normal administrative activity per account and alert on deviations in call rate or endpoint mix.
• Monitor for unexpected POST requests to tenant creation routes and DELETE requests against user resources.

How to Mitigate CVE-2026-75419

Immediate Actions Required

• Upgrade go-wind-cms to version 1.0.0 or later once a fixed release is confirmed by the maintainer.
• Restrict network exposure of the admin service to trusted management networks until patched.
• Rotate credentials for privileged accounts and audit recent administrative actions for signs of abuse.

Patch Information

Refer to the maintainer's repository and the GitHub Issue Discussion on CMS for the fix status. The remediation replaces the noop.State{} return in NewAuthorizer() with a functional authorization engine that enforces role and tenant checks in the authz middleware.

Workarounds

• Front the admin service with an API gateway that enforces role-based access control before requests reach the vulnerable middleware.
• Disable or firewall administrative endpoints (/admin/*) for all sessions originating outside a trusted operator network.
• Implement a reverse-proxy allowlist that maps authenticated user identities to permitted administrative routes.

# Example nginx allowlist restricting admin routes to an operator subnet
location /admin/ {
    allow 10.0.10.0/24;
    deny all;
    proxy_pass http://go-wind-cms-admin;
}