Description
Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend FileUpload form widget trusted an attacker-controlled file_id POST parameter when resolving the attachment it operates on, allowing an authenticated backend user to read and modify attachment records belonging to other users or records. The widget's getFileRecord() lookup resolved the posted id against the global system_files table without verifying that the file belonged to the widget's own relation, parent record, or deferred-binding session. Because all attachments share a single File model and table and attachment ids are sequential integers that are easily enumerated, a user reaching any form with a fileupload field, including the built-in My Account avatar field that requires no specific permission, could target arbitrary attachments to modify their title and description via onSaveAttachmentConfig and change their sort order via onSortAttachments, which passed posted ids straight to an unscoped update. CSRF tokens remain enforced, so exploitation requires a valid authenticated backend session with any level of access. This issue is fixed in version 1.2.13.
Published: 2026-08-26
Score: 5.4 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Authenticated backend users can read and edit the title, description, and order of file attachments belonging to other users because the FileUpload widget trusts an attacker‑controlled file_id parameter. The lack of ownership validation allows an IDOR (Insecure Direct Object Reference) that exposes attachment metadata and may provide insight into user content. The flaw aligns with access‑control weaknesses (CWE-284) and authorization bypass via a user‑controlled key (CWE-639).

Affected Systems

Winter CMS, versions up to and including 1.2.12. Versions 1.2.13 and later contain the fix.

Risk and Exploitability

The CVSS score of 5.4 indicates a moderate severity. EPSS data is unavailable and the vulnerability is not listed in CISA KEV. Because CSRF protection is in place, exploitation still requires a valid authenticated backend session, but any user with backend access can enumerate attachment IDs and target arbitrary records. The attack vector is thus authenticated, internal via the CMS admin interface, with moderate potential impact on confidentiality and integrity of attachment metadata.

Generated by OpenCVE AI on August 26, 2026 at 19:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Winter CMS to version 1.2.13 or later to apply the vendor fix.
  • For environments that cannot upgrade immediately, restrict backend users to only those roles that require access to the FileUpload widget, or disable fileupload fields on forms that do not need them.
  • Review and adjust any custom backend code that interacts with file records to include explicit ownership checks before performing updates or deletions.

Generated by OpenCVE AI on August 26, 2026 at 19:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-3277-h8g9-qj5f Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata
History

Wed, 26 Aug 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Wintercms
Wintercms winter
Vendors & Products Wintercms
Wintercms winter

Wed, 26 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend FileUpload form widget trusted an attacker-controlled file_id POST parameter when resolving the attachment it operates on, allowing an authenticated backend user to read and modify attachment records belonging to other users or records. The widget's getFileRecord() lookup resolved the posted id against the global system_files table without verifying that the file belonged to the widget's own relation, parent record, or deferred-binding session. Because all attachments share a single File model and table and attachment ids are sequential integers that are easily enumerated, a user reaching any form with a fileupload field, including the built-in My Account avatar field that requires no specific permission, could target arbitrary attachments to modify their title and description via onSaveAttachmentConfig and change their sort order via onSortAttachments, which passed posted ids straight to an unscoped update. CSRF tokens remain enforced, so exploitation requires a valid authenticated backend session with any level of access. This issue is fixed in version 1.2.13.
Title Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata
Weaknesses CWE-284
CWE-639
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Wintercms Winter
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-26T17:53:36.237Z

Reserved: 2026-06-12T16:25:43.086Z

Link: CVE-2026-54256

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-26T18:16:40.780

Modified: 2026-08-26T18:16:40.780

Link: CVE-2026-54256

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T20:00:11Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-639

    Authorization Bypass Through User-Controlled Key