CVE-2026-125337

{
  "etk_id": "ETK-2026-4094",
  "cve_id": "CVE-2026-125337",
  "display_id": "CVE-2026-125337",
  "ghsa_id": "GHSA-fm29-4mq3-phg6",
  "euvd_id": "EUVD-2026-122882",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization bypass in Winter CMS import/export handlers",
  "summary": "Winter CMS import and export handlers can bypass configured granular permissions in affected controller configurations. An authenticated backend user with access to the controller, but without the configured import or export permission, may retrieve exported data or alter records; the controller must use the granular permission settings for exposure to occur.",
  "mitigation": "Upgrade the winter package to version 1.2.14. Until then, enforce the import and export restrictions through each affected controller's required-permissions configuration rather than relying only on granular behavior permissions.",
  "vendor": "wintercms",
  "product": "winter",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 1.2.13"
      ],
      "ecosystem": "composer",
      "fixed_versions": [
        ">= 1.2.14"
      ],
      "package_name": "winter/wn-backend-module",
      "purl": "pkg:composer/winter/wn-backend-module"
    }
  ],
  "cwes": [
    862
  ],
  "cvss_score": 8.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 15.064088333333332,
  "t0_at": "2026-11-10T20:01:12.977000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-10T20:01:12.977000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-10T20:01:12.977000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-125337"
    }
  }
}