CVE-2026-125337 Winter CMS: ImportExportController AJAX handlers bypass granular import/export permission gate

Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, the ImportExportController behavior applies userHasAccess only to the import and export page actions, while Backend\Classes\Controller::execAjaxHandlers dispatches onImport, onImportLoadForm,...

CVE-2026-125337

Prior to version 1.2.14 , Winter CMS (built on Laravel) contained a broken access control vulnerability in the ImportExportController . While granular permissions for import/export operations were configured, the userHasAccess() check was only applied to specific page actions. Consequently, AJAX ...