CVE-2026-27591

Winter: Privilege escalation by authenticated backend users

State: Published
Severity: 10.0 Critical
Published: Mar 11, 2026
Updated: Mar 12, 2026
Reserved: Feb 20, 2026

Description

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.0.477, 1.1.12, and 1.2.12, Winter CMS allowed authenticated backend users to escalate their accounts level of access to the system by modifying the roles / permissions assigned to their account through specially crafted requests to the backend while logged in. To actively exploit this security issue, an attacker would need access to the Backend with a user account with any level of access. This vulnerability is fixed in 1.0.477, 1.1.12, and 1.2.12.

Scores

CVSS	Score	Vector	Source
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-284 Improper Access Control
CWE-639 Authorization Bypass Through User-Controlled Key
CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

Affected Products

Product	Versions
winterwintercms	>= 1.2.0, < 1.2.12Affected >= 1.1.0, < 1.1.12Affected < 1.0.477Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.