← Vulnerability feed

Vulnerability record · CVE-2026-27591 · published 11 March 2026

CVE-2026-27591: Wintercms winter improper access control vulnerability

Wintercms · Winter

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.0.477, 1.1.12, and 1.2.12, Winter CMS allowed authenticated backend users to escalate their accounts level of access to the system by modifying the roles / permissions assigned to their account through specially crafted requests to the backend while logged in. To actively exploit this security issue, an attacker would need access to the Backend with a user account with any level of access. This vulnerability is fixed in 1.0.477, 1.1.12, and 1.2.12.

9.9 CVSS 3.1 Critical EPSS 0.57% · top 55.3% CWE-284 · Improper access controlCWE-639 · Insecure direct object reference
9.9CVSS 3.1 base score
0.57%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.0.477, 1.1.12, and 1.2.12, Winter CMS allowed authenticated backend users to escalate their accounts level of access to the system by modifying the roles / permissions assigned to their account through specially crafted requests to the backend while logged in. To actively exploit this security issue, an attacker would need access to the Backend with a user account with any level of access. This vulnerability is fixed in 1.0.477, 1.1.12, and 1.2.12.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/wintercms/winter/security/advisories/GHSA-pgpf-m8m4-6cg6 PatchVendor Advisory
https://wintercms.com/releases/v1.0.477 Release Notes
https://wintercms.com/releases/v1.1.12 Release Notes
https://wintercms.com/releases/v1.2.12 Release Notes

Track CVE-2026-27591 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-39357Wintercms winter prototype pollution vulnerabilityWinter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9, and 1.2…EPSS 1.1%8.4CVE-2024-54149Wintercms winter vulnerabilityWinter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0…EPSS 0.42%7.2CVE-2024-29686Wintercms winter vulnerabilityServer-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to…EPSS 1.8%5.4CVE-2023-52085Wintercms winter path traversal vulnerabilityWinter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value…EPSS 30%5.4CVE-2023-52084Wintercms winter cross-site scripting vulnerabilityWinter is a free, open-source content management system. Prior to 1.2.4, Users with access to backend forms that include a ColorPicker FormWidget can…EPSS 0.31%4.8CVE-2023-52083Wintercms winter cross-site scripting vulnerabilityWinter is a free, open-source content management system. Prior to 1.2.4, users with the `media.manage_media` permission can upload files to the Media…EPSS 0.31%4.8CVE-2023-37269Wintercms winter cross-site scripting vulnerabilityWinter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Users with the `backend.manage_branding` permission…EPSS 2.7%3.5CVE-2026-22254Wintercms winter cross-site scripting vulnerabilityWinter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users wi…EPSS 0.27%

Source: NIST National Vulnerability Database (record CVE-2026-27591), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.