The vulnerability stems from a missing authorization check in the GoWind CMS before version 1.0.0. A function called NewAuthorizer returns a no‑op engine, meaning the middleware accepts all authenticated requests without further validation. As a result, anyone who can authenticate to the application can call administrative endpoints such as deleting users, resetting passwords, or creating tenants, gaining control equivalent to a full system administrator.

The flaw affects GoWind CMS (GoWind), specifically the data.go files located in app/admin/service/internal/data and app/app/service/internal/data for all releases prior to 1.0.0. No other vendors or products are listed, but any deployment using these modules is vulnerable.

The CVSS score of 8.8 signals high severity. Although the EPSS score is not available, the lack of a KEV listing does not reduce the potential damage. Once an attacker authenticates—either through legitimate credentials or a stolen account—they can exploit the no‑op authorizer to execute privileged administrative actions. The likely attack vector is a remote request to the application after authentication, but for environments exposing the service locally, the vector could be local as well.