{"id":"CVE-2026-125339","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-125339","summary":"Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.319 until 1.2.14, Backend\\Classes\\Controller::actionExists() accepts public handler-shaped methods…","details":"Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.319 until 1.2.14, Backend\\Classes\\Controller::actionExists() accepts public handler-shaped methods as page actions, so a top-level GET request can invoke state-changing backend AJAX handlers without a CSRF token. Because backend routes use Route::any, CSRF validation skips GET, and the default SameSite=Lax session cookie is sent on cross-site navigation, an unauthenticated attacker can induce an authorized backend user to follow a link such as /backend/system/eventlogs/index_onEmptyLog. Affected handlers in the backend, CMS, and system modules can truncate logs, reset settings, alter backend user state, or delete CMS templates, while URL path segments can select a target record. This issue is fixed in version 1.2.14.","published":"2026-11-10T20:19:08.410","modified":"2026-11-10T20:19:08.410","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/wintercms/winter/commit/353b23804dee2acf49fca996c72637040446824f","label":"wintercms/winter@353b238"},"references":[{"type":"WEB","url":"https://github.com/wintercms/winter/commit/353b23804dee2acf49fca996c72637040446824f"},{"type":"WEB","url":"https://github.com/wintercms/winter/releases/tag/v1.2.14"},{"type":"WEB","url":"https://github.com/wintercms/winter/security/advisories/GHSA-p2ch-c2c3-4xm5"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-11-10T20:19:08.410"}}