CVE-2026-27591 - Vulnerability Analysis

Overview

Winter CMS < 1.0.477, < 1.1.12, and < 1.2.12 contains a broken access control vulnerability caused by improper validation of role and permission modifications, letting authenticated backend users escalate privileges, exploit requires authenticated backend access.

Severity & Score

Impact

Authenticated backend users can escalate their privileges, potentially gaining full administrative control.

Mitigation

Upgrade to versions 1.0.477, 1.1.12, or 1.2.12 or later.

References

• https://github.com/wintercms/winter/security/advisories/GHSA-pgpf-m8m4-6cg6
• https://wintercms.com/releases/v1.0.477
• https://wintercms.com/releases/v1.1.12
• https://wintercms.com/releases/v1.2.12

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 13, 2026

🔴 CVE-2026-27591 - Critical (9.9) Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.0.477, 1.1.12, and 1.2.12, Winter CMS allowed authenticated backend users to escalate their accounts level of access to the system by modi... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27591/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner