CVE-2026-125339

Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.319 until 1.2.14, Backend\Classes\Controller::actionExists() accepts public handler-shaped methods as page actions, so a top-level GET request can invoke state-changing backend AJAX handlers without a CSRF token. Because backend routes use Route::any, CSRF validation skips GET, and the default SameSite=Lax session cookie is sent on cross-site navigation, an unauthenticated attacker can induce an authorized backend user to follow a link such as /backend/system/eventlogs/index_onEmptyLog. Affected handlers in the backend, CMS, and system modules can truncate logs, reset settings, alter backend user state, or delete CMS templates, while URL path segments can select a target record. This issue is fixed in version 1.2.14.

• CWE-352

• https://github.com/wintercms/winter/commit/353b23804dee2acf49fca996c72637040446824f
• https://github.com/wintercms/winter/releases/tag/v1.2.14
• https://github.com/wintercms/winter/security/advisories/GHSA-p2ch-c2c3-4xm5

Published

Nov 10, 2026

Last Modified

Nov 10, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-125333Forge (also called node-forge) is a native implementation of…5.9
• CVE-2026-125334Forge (also called node-forge) is a native implementation of…5.9
• CVE-2026-125335Forge (also called node-forge) is a native implementation of…3.7
• CVE-2026-125336Forge (also called node-forge) is a native implementation of…7.4
• CVE-2026-125337Winter CMS is a content management system built on the Larav…8.3
• CVE-2026-125338Winter CMS is a content management system built on the Larav…4.5
• CVE-2026-125340Winter CMS is a content management system built on the Larav…4.5
• CVE-2026-125341Winter CMS is a content management system built on the Larav…2
• CVE-2026-125342Uninitialized resource in GPU in Google Chrome prior to 157.…4.7
• CVE-2026-125343Buffer overflow in Compositing in Google Chrome prior to 157…
• CVE-2026-125344Type confusion in V8 in Google Chrome prior to 157.0.8103.50…
• CVE-2026-125345Uninitialized resource in WebGL in Google Chrome prior to 15…