Threats affecting pkg:github/wintercms/winter

CVE-2026-27591 is a critical improper access control vulnerability in Winter CMS, a Laravel-based content management system. Authenticated backend users with any level of access can exploit this flaw to escalate their privileges by manipulating roles and permissions via crafted backend requests. This vulnerability affects Winter CMS versions prior to 1.0.477, 1.1.12, and 1.2.12. Exploitation requires an authenticated backend user account but no user interaction beyond that.