Improper Input Validation in Winter CMS Backend Postback

Winter CMS contains an improper input validation vulnerability (CVE-2026-35445) affecting the form postback mechanism. The vulnerability exists because the system fails to validate the _handler POST field submitted during form postbacks, whereas it correctly validates the X_WINTER_REQUEST_HANDLER header used in AJAX requests. This flaw allows an authenticated backend user to invoke restricted methods on controllers.

The issue is particularly critical within the Users controller, where the $requiredPermissions property was conditionally set to null for the myaccount action. An attacker with a low-privilege backend session can chain this postback bypass with the insecure permissions check to trigger sensitive administrative methods - including user deletion, restoration, and password resets - despite lacking the backend.manage_users permission. All major versions of Winter CMS (1.0, 1.1, and 1.2) were vulnerable prior to version 1.2.13.

Impact

Successful exploitation allows authenticated backend users to escalate privileges and perform unauthorized administrative actions, including user deletion, restoration, and forced password resets, bypassing existing role-based access control (RBAC) configurations. This impacts the integrity and availability of user accounts and the overall security of the Winter CMS backend.

Recommendation

• Upgrade to Winter CMS version 1.2.13 or later to receive the core patch which enforces validation on the _handler POST field.
• If an immediate upgrade is not possible, apply the following manual workarounds:
• Modify modules/backend/classes/Controller.php to validate the _handler POST field against the on[A-Z][\w+]* pattern before passing it to runAjaxHandler().
• Update modules/backend/controllers/Users.php to remove the conditional logic that sets $requiredPermissions to null for the myaccount action.