Winter CMS Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in Winter CMS versions prior to 1.0.477, 1.1.12, and 1.2.12. This vulnerability allows authenticated backend users to increase their access level by manipulating the roles and permissions assigned to their accounts. The issue arises from the ability to send specially crafted requests to the backend while logged in. To exploit this vulnerability, an attacker must have access to the backend with a user account that has any level of access.

Impact

Exploitation of this vulnerability allows for unauthorized modification of user roles and permissions, leading to elevated access rights within the Winter CMS backend.

Remediation

Users are advised to update Winter CMS to version 1.0.477, 1.1.12, or 1.2.12. If an immediate upgrade is not possible, the changes from these releases can be applied manually to resolve the issue.