CVE-2026-32639: Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads

medium Affects winter/wn-cms-module. Feed 2026.10.29.1, updated 2026-10-28; published 2026-08-12.

Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads

Package: winter/wn-cms-module Composer
Affected versions: <1.2.13
Fixed in: 1.2.13
Severity: medium CVSS 6.8
Exploitation: not on CISA KEV · EPSS 0% (39.7th percentile)
Published: 2026-08-12
Source: osv.dev

References

NVD record winter/wn-cms-module advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

CVE-2024-54149 high Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification same package: winter/wn-cms-module
CVE-2026-22254 low Winter CMS has Stored Cross-site Scripting (XSS) in Asset Manager same package: winter/wn-cms-module
CVE-2021-38312 high The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an in same weakness: CWE-280
CVE-2024-25108 critical Pixelfed doesn't check OAuth Scopes in API routes, giving elevated permissions same weakness: CWE-280
CVE-2024-6660 high The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin same weakness: CWE-280
CVE-2025-67848 high Moodle authentication bypass vulnerability same weakness: CWE-280