CVE-2026-27591: Winter CMS: privilege escalation by authenticated backend users
CVE-2026-27591 is an improper access control flaw in Winter CMS, a Laravel-based content management system. Authenticated backend users could change the roles and permissions of their own accounts through crafted requests, raising their level of access. The vendor fixed it in the releases listed in the affected ranges below.
Overview
CVE-2026-27591 affects Winter CMS, a free and open-source content management system built on the Laravel PHP framework. According to the record, the weakness is classified as improper access control (CWE-284). It allows a user who already has a backend account to modify the roles and permissions assigned to that account.
Impact
- An authenticated backend user with any level of access may gain higher privileges within the CMS.
- The record describes the technical impact as total, and the scores assigned in the record are high (CVSS 9.9 from the GitHub source, 10 from another provider).
- Exploitation requires a valid backend account, so the attack prerequisite is authentication rather than anonymous access.
Affected products and versions
The record lists Winter CMS (product name Wintercms Winter) with these affected ranges:
- Before 1.0.477.
- From 1.1.0 before 1.1.12.
- From 1.2.0 before 1.2.12.
The fixed releases are 1.0.477, 1.1.12 and 1.2.12. Installations on branches not covered by these ranges are not described in the record, so their status is unknown.
Exploitation status
The CISA KEV catalog does not list this CVE in the data consulted, and the SSVC fields in the record show exploitation as none and automatable as no. The EPSS probability is 0.0086. No confirmed exploitation in the wild appears in the sources consulted.
Remediation and mitigation
- Upgrade Winter CMS to the fixed release for your branch: 1.0.477, 1.1.12 or 1.2.12, as applicable.
- Review the official GitHub security advisory for vendor guidance and confirm your installed version.
- Until patching is complete, limit backend account creation and restrict backend access to trusted users and networks, applying the principle of least privilege.
- Audit existing backend accounts for unexpected roles or permissions.
Detection guidance
- Review backend audit logs, if enabled, for changes to user roles and permissions made by non-administrative accounts.
- Look for unexpected elevation of account privileges or new administrative-level assignments.
- Correlate backend activity with authentication logs to identify accounts used in unusual ways.
Limitations of the available information
The record does not provide proof-of-concept details, public exploit availability, or workarounds beyond upgrading. It does not state whether any affected installation has been compromised. Some details, such as the exact set of affected configurations, are taken from the vendor advisory and the NVD and CVE records, which were consulted for this analysis.
Frequently asked questions
What is the core problem in CVE-2026-27591?
Authenticated backend users of Winter CMS could change the roles and permissions of their own accounts through crafted requests, which raised their access level beyond what was intended.
Which versions are fixed?
The record states the fix is in 1.0.477, 1.1.12 and 1.2.12. Affected ranges are before 1.0.477, from 1.1.0 before 1.1.12, and from 1.2.0 before 1.2.12.
Is this vulnerability known to be actively exploited?
The CISA KEV catalog does not list it in the data consulted, and no confirmed exploitation in the wild appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.