CVE-2026-54256: CWE-284: Improper Access Control in wintercms winter

In Winter CMS (winter) versions up to and including 1.2.12, the backend FileUpload form widget improperly trusts an attacker-controlled file_id POST parameter when resolving attachments. The getFileRecord() function looks up the posted file ID against the global system_files table without verifying that the file belongs to the widget's relation, parent record, or deferred-binding session. Because all attachments share a single File model and table and attachment IDs are sequential and enumerable, any authenticated backend user with any level of access can target arbitrary attachments to read or modify their title, description, and sort order. The exploitation requires a valid authenticated backend session and CSRF tokens are enforced. This issue is resolved in Winter CMS version 1.2.13.

An authenticated backend user with any level of access can read and modify attachment records belonging to other users or records. This includes changing attachment titles, descriptions, and sort order. The vulnerability does not allow unauthenticated access and requires a valid backend session. There is no indication of denial of service or code execution impact.

Upgrade Winter CMS to version 1.2.13 or later where this vulnerability is fixed. Since the vulnerability requires an authenticated backend session and CSRF tokens are enforced, ensure that backend access is tightly controlled and that users have appropriate permissions until the upgrade is applied.