Winter CMS backend module versions before 1.2.13 did not validate the _handler POST field in the same way as AJAX requests, allowing authenticated backend users to invoke any controller method, including protected and private ones, by submitting crafted POST requests. The Users controller specifically allowed bypass of the backend.manage_users permission for the myaccount action, enabling unauthorized calls to sensitive user management methods such as update_onDelete and update_onManualPasswordReset. Exploitation requires an authenticated backend session. The fix in 1.2.13 enforces handler name validation on postback requests, moves My Account functionality to a dedicated controller without user management methods, and applies model-level protections against unauthorized user modifications.

Authenticated backend users with any level of access can bypass permission checks on the Users controller to invoke sensitive user management functions without proper authorization. This could lead to unauthorized deletion, restoration, suspension, unsuspension, or password reset of user accounts. However, exploitation requires a valid authenticated session and cannot be performed by unauthenticated attackers due to CSRF token verification on POST requests.

A security fix is available and has been backported to all major Winter CMS versions (1.0, 1.1, and 1.2). Users should update to version 1.2.13 or later immediately. If upgrading is not possible, manual mitigations include validating the _handler POST field against the on[A-Z][\w+]* pattern before dispatching handlers and removing the conditional permission bypass in the Users controller for the myaccount action.