The ImportExportController fails to enforce granular permission checks on its AJAX handlers. This flaw, identified as CWE-862 and CWE-863, allows an authenticated backend user lacking import or export permissions to invoke import handlers to write or overwrite records and use export handlers to download the full dataset, effectively bypassing permission gate. This permits unauthorized data modification and disclosure, leading to privilege escalation and data integrity compromise.

Winter CMS versions 1.2.13 and earlier are affected. The software, built on Laravel, uses Controller::execAjaxHandlers. The fix is included in 1.2.14.

The CVSS score of 8.3 indicates high severity, and the EPSS score of less than 1% suggests current exploitation probability is low. The vulnerability is not listed in CISA KEV. An attacker needs an authenticated backend session, so the exploit can be performed by a user with backend access or by compromising backend credentials, enabling covert data manipulation and eavesdropping.