Winter CMS, built on Laravel, has a vulnerability (CVE-2026-32639) in versions prior to 1.2.13 where the CMS Theme Editor AJAX handlers fail to enforce specific permissions per template type. The CMS controller uses OR-logic across five permissions for section access, but individual AJAX handlers like onSave(), onDelete(), and onDeleteTemplates() do not verify that the user holds the exact permission for the template type requested. Consequently, a user with only cms.manage_pages permission can delete layouts, modify partials, or read content files outside their authorized scope. Furthermore, the AssetList widget is accessible to any user passing the controller gate regardless of cms.manage_assets permission, and its onUpload() handler lacks theme validation, enabling unauthorized file uploads to the active theme's asset directory. Exploitation requires an authenticated backend user with at least one CMS Theme Editor permission. The vulnerability is resolved in version 1.2.13.

An authenticated backend user with any single CMS Theme Editor permission can bypass intended permission restrictions to modify or delete templates outside their authorized scope, and upload unauthorized files to the active theme's asset directory. This can lead to unauthorized content modification and potential asset injection. The CVSS score is 6.8 (medium severity) with high confidentiality impact but no integrity or availability impact.

Upgrade Winter CMS to version 1.2.13 or later, where this issue is fixed. Users should ensure that backend accounts have only necessary CMS permissions. No additional mitigations are specified by the vendor advisory.