Affected versions of Winter CMS did not enforce specific permission checks for different template types in the CMS section's AJAX handlers within the Cms\Controllers\Index controller. The controller used OR-logic across five permissions to gate access, but individual handlers like onSave(), onDelete(), and onDeleteTemplates() did not verify that the user held the permission corresponding to the requested template type. This flaw allowed backend users with any one Theme Editor permission (e.g., cms.manage_pages) to craft AJAX requests affecting other template types outside their authorized scope, including deleting layouts or modifying partials. Furthermore, the AssetList widget was registered for all users passing the controller gate regardless of cms.manage_assets permission, and its onUpload() handler lacked the validateRequestTheme() call, enabling unauthorized file uploads to the active theme's asset directory. The vulnerability requires authenticated backend access with any of the listed permissions. Winter CMS version 1.2.13 includes patches enforcing per-template-type permission checks on all Theme Editor AJAX handlers, restricts AssetList widget registration to users with cms.manage_assets permission, and adds theme validation to the onUpload() handler.

An attacker with backend access and any single Theme Editor permission can perform unauthorized actions on template types outside their permission scope, such as deleting or modifying templates they should not control. They can also upload unauthorized files to the active theme's asset directory. This could lead to unauthorized content manipulation and potential introduction of malicious assets within the CMS. The vulnerability affects confidentiality and integrity of CMS content but does not impact availability.

A patch is available in Winter CMS version 1.2.13 that enforces per-template-type permission checks on all Theme Editor AJAX handlers, restricts the AssetList widget to users with the cms.manage_assets permission, and adds theme validation to the onUpload() handler. Users are strongly advised to update to version 1.2.13 immediately. If upgrading is not possible, manual mitigations include adding permission checks around widget registrations in modules/cms/controllers/Index.php and adding validateRequestTheme() calls in the AssetList widget's onUpload() method as detailed in the advisory.