Winter CMS backend module versions before 1.2.13 fail to validate the _handler POST field in form postbacks, enabling authenticated backend users to invoke arbitrary controller methods, including protected and private ones. AJAX requests enforce a handler name pattern, but the postback path does not, allowing bypass of roles and permissions. The Users controller's myaccount action sets $requiredPermissions to null, permitting any authenticated backend user to execute sensitive user-management methods like update_onDelete and update_onManualPasswordReset without the backend.manage_users permission. This vulnerability is resolved in version 1.2.13.

Authenticated backend users can bypass permission checks and invoke sensitive user-management functions without proper authorization. This could lead to unauthorized user deletions or password resets, compromising user accounts and administrative control within the CMS.

Upgrade Winter CMS backend module to version 1.2.13 or later, where this vulnerability is fixed. Applying this official patch eliminates the permission bypass issue. No additional mitigation is required once the update is applied.