Critical severity9.9NVD Advisory· Published Mar 11, 2026· Updated Jun 17, 2026
CVE-2026-27591
CVE-2026-27591
Description
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.0.477, 1.1.12, and 1.2.12, Winter CMS allowed authenticated backend users to escalate their accounts level of access to the system by modifying the roles / permissions assigned to their account through specially crafted requests to the backend while logged in. To actively exploit this security issue, an attacker would need access to the Backend with a user account with any level of access. This vulnerability is fixed in 1.0.477, 1.1.12, and 1.2.12.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
winter/wn-backend-modulePackagist | >= 1.2.0, < 1.2.12 | 1.2.12 |
winter/wn-backend-modulePackagist | >= 1.1.0, < 1.1.12 | 1.1.12 |
winter/wn-backend-modulePackagist | < 1.0.477 | 1.0.477 |
Affected products
3Patches
Vulnerability mechanics
References
6- github.com/wintercms/winter/security/advisories/GHSA-pgpf-m8m4-6cg6nvdPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-pgpf-m8m4-6cg6ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-27591ghsaADVISORY
- wintercms.com/releases/v1.0.477nvdRelease NotesWEB
- wintercms.com/releases/v1.1.12nvdRelease NotesWEB
- wintercms.com/releases/v1.2.12nvdRelease NotesWEB
News mentions
0No linked articles in our index yet.