# Winter: Authenticated backend users can bypass Users controller permission checks

Winter CMS postback path skipped handler-name validation, letting any authenticated backend user invoke protected Users controller methods like manual password reset.

- Payout: Research
- Severity: high
- Program: Winter CMS
- Found by: everythingBlackkk
- Disclosed: 2026-08-12
- CVE: CVE-2026-35445
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-j5jq-cr68-v2xx
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-j5jq-cr68-v2xx
- Tags: area:web domain:web impact:ato impact:privesc kind:research platform:ghsa sev:high tech:php technique:source-review vuln:access-control vuln:account-takeover vuln:auth-bypass vuln:privilege-escalation

**Target:** Backend controller handler dispatcher (POST `_handler` field)
**Root cause:** The postback path passed the `_handler` POST value straight to the handler dispatcher without the `on[A-Z][\w+]*` validation applied to the AJAX header path, and the Users controller nulled `$requiredPermissions` for the `myaccount` action, exposing all its methods to any backend user.
**Steps:**
1. Authenticate to the Winter backend with any low-privilege account and obtain a valid session plus CSRF token.
2. Send a POST request to the Users controller endpoint with `_handler=update_onManualPasswordReset` (or `update_onDelete`, `update_onRestore`, `update_onUnsuspendUser`) and attacker-controlled parameters.
3. Because `_handler` is unvalidated on the postback path, the dispatcher invokes the protected/private method despite lacking `backend.manage_users`.
**How found:** Reporter compared the two handler entry points and noticed the AJAX path enforced an `on[A-Z][\w+]*` regex while the postback path did not, then looked for controllers whose permission checks degrade conditionally — finding Users nulls `$requiredPermissions` for `myaccount`.
**Exploitation:** Any authenticated backend user with a valid session and CSRF token POSTs a crafted `_handler` value to the Users controller (reachable because `myaccount` nulls `$requiredPermissions`), invoking user-management methods such as manual password reset, delete, restore, or unsuspend with attacker-chosen parameters — enabling account takeover or destruction of other backend users.
**Escalation:** Low-privilege backend account escalates to control over other backend user records via manual password reset, potentially reaching administrator accounts.
**Insight:** When a framework has two entry points to the same dispatcher (header vs POST body), diff their validation; then hunt controllers that conditionally null `$requiredPermissions` for one public action, since that exposes every other method on the controller.