Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback _handler POST field, allowing an authenticated backend user to invoke arbitrary controller methods, including protected, private, and action-prefixed ones. While AJAX requests validate that handler names match the on[A-Z][\w+]* pattern, the postback path passed the submitted _handler value straight to the handler dispatcher with no such check, so any controller that exposes a public action or conditionally relaxes its $requiredPermissions check could be reached, bypassing the roles and permissions system. The built-in Users controller was affected because it set $requiredPermissions to null for the myaccount action, letting any authenticated backend user invoke user-management methods such as update_onDelete and update_onManualPasswordReset without holding the backend.manage_users permission. This issue is fixed in version 1.2.13.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-26 | 1 | Disclosure1 |
| 2026-08-27 | 2 | Disclosure2 |
CVE-2026-35445 Winter CMS Authenticated Arbitrary Controller Method Invocation Vulnerability https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35445
Post summary
CVE‑2026‑35445 is a newly disclosed vulnerability in Winter CMS that allows authenticated users to invoke arbitrary controller methods, which could enable further exploitation. No additional PoC, exploit code, or active attack evidence is provided.
🚨*CVE* CVE-2026-35445 Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted thr… https://www.cve.org/CVERecord?id=CVE-2026-35445 ----- Traducción: CVE-2026-35445 Win… https://infoflow.cloud`
Post summary
CVE‑2026‑35445 is a validation flaw in Winter CMS (Laravel‑based CMS) affecting versions before 1.2.13, where the backend fails to validate handler names; no PoC, exploit, patch, or active exploitation is mentioned.
CVE-2026-35445 Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted thr… https://www.cve.org/CVERecord?id=CVE-2026-35445
Post summary
The post announces the existence of CVE-2026-35445 in Winter CMS, noting a flaw where backend validation of handler names is missing, but provides no PoC, exploit, patches, or evidence of active exploitation.