GHSA-MPMW-F6H6-3G26

Winter: My Account preview exposes another backend user's profile by record ID

public function formExtendQuery(\Winter\Storm\Database\Builder $query): void
{
    $query->whereKey($this->user->getKey());
}

Backend\Controllers\MyAccount, introduced in v1.2.13, declares an empty $requiredPermissions array so that any authenticated backend user can manage their own account. It implements the FormController behavior, which exposes three routable actions, create, update and preview, that each take a record id from the URL.

index() passes the authenticated user's own id to the behavior, but the inherited actions were left routable and formFindModelObject() was not scoped, so a caller-supplied id resolved against an unscoped Backend\Models\User query:

GET /backend/backend/myaccount/preview/{other_user_id}

preview disclosed the target user's first name, last name, login, email address and avatar; update was equally routable and additionally disclosed role, group membership, superuser flag and throttle state. Password controls render a mask, so no credential material was exposed. Backend user ids are sequential and trivially enumerated, and as these are GET actions no CSRF token is involved.

The behavior's AJAX handlers (create_onSave, update_onSave, update_onDelete) were also dispatchable on these routes, but cross-user writes were blocked by the Backend\Models\User authorization guards added in v1.2.13. The confirmed impact is unauthorized disclosure of backend user profile data.

To actively exploit this security issue, an attacker would need access to the Backend with a user account with any level of access.

GHSA-MPMW-F6H6-3G26 has a CVSS score of 4.3 (Medium). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.2.14); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

MyAccount no longer exposes the generic record actions it never used as routes, and its form lookup is now pinned to the authenticated user:

• protected $guarded = ['create', 'update', 'preview']; removes the inherited actions from routing. The guard has to be at the routing layer, as handler dispatch ({action}_{handler}) runs before the page action.
• formExtendQuery() constrains every lookup made by the behavior to the current user's key.

This security issue has been fixed as of v1.2.14 (commit cdbc8f5a23db27f72ccec658a8e5769e6d9f6dcb).

1. What is GHSA-MPMW-F6H6-3G26? GHSA-MPMW-F6H6-3G26 is a medium-severity security vulnerability in winter/wn-backend-module (composer), affecting versions = 1.2.13. It is fixed in 1.2.14.
2. How severe is GHSA-MPMW-F6H6-3G26? GHSA-MPMW-F6H6-3G26 has a CVSS score of 4.3 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of winter/wn-backend-module are affected by GHSA-MPMW-F6H6-3G26? winter/wn-backend-module (composer) versions = 1.2.13 is affected.
4. Is there a fix for GHSA-MPMW-F6H6-3G26? Yes. GHSA-MPMW-F6H6-3G26 is fixed in 1.2.14. Upgrade to this version or later.
5. Is GHSA-MPMW-F6H6-3G26 exploitable, and should I be worried? Whether GHSA-MPMW-F6H6-3G26 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether GHSA-MPMW-F6H6-3G26 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix GHSA-MPMW-F6H6-3G26? Upgrade winter/wn-backend-module to 1.2.14 or later.

Other vulnerabilities in winter/wn-backend-module