CVE-2026-27591
1 advisory.
Packagist/winter/wn-backend-module CVE-2026-27591: critical 9.9, EPSS 0.86%
Winter vulnerable to privilege escalation by authenticated backend users
Action: Upgrade winter/wn-backend-module to 1.0.477 or later.
composer require winter/wn-backend-module:1.2.12composer require winter/wn-backend-module:1.1.12composer require winter/wn-backend-module:1.0.477Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.2.0 | 1.2.12 | - |
| 1.1.0 | 1.1.12 | - |
| 0 | 1.0.477 | - |
Fixed versions
| 1.2.12 | 1.1.12 | 1.0.477 |
Sources
- osv: GHSA-pgpf-m8m4-6cg6
- https://github.com/wintercms/winter/security/advisories/GHSA-pgpf-m8m4-6cg6
- https://nvd.nist.gov/vuln/detail/CVE-2026-27591
- https://github.com/wintercms/winter
- https://wintercms.com/releases/v1.0.477
- https://wintercms.com/releases/v1.1.12
- https://wintercms.com/releases/v1.2.12
CVE-2026-27591 · published · modified · JSON