In Winter CMS versions before 1.2.13, the handler name supplied by a backend user in the _handler POST field is not validated by the postback handler dispatcher. This omission allows the user to invoke any controller method—including private or protected methods—if the controller is reachable. The system’s permission checks can be bypassed because the dispatcher does not enforce the controller’s $requiredPermissions, permitting actions such as updating or deleting user accounts or resetting passwords without the required backend.manage_users right.

Any installation of Winter CMS older than version 1.2.13 is vulnerable, particularly where the Users controller exposes public actions or relaxes permission checks.

The CVSS score of 7.1 marks this vulnerability as high severity. While an EPSS score is not available, the vulnerability is not listed in the CISA KEV catalog. The attack requires legitimate backend authentication but then sidesteps established role checks, making exploitation straightforward for any logged‑in user. The combination of a moderate-to-high severity score and minimal prerequisites suggests a notable risk to affected systems.