{"action":"Upgrade winter/wn-cms-module to 1.2.13 or later.","affected":[{"fixed":"1.2.13","introduced":"0"}],"component":"winter/wn-cms-module","cve_ids":["CVE-2026-32639"],"ecosystem":"Packagist","epss":0.00459,"exploited":false,"fixed_versions":["1.2.13"],"ghsa_id":"GHSA-5c4f-9pq9-6c77","id":"tcs_01M5KEVXW8XN2B9N24TJMWXP3S","modified_at":"2026-08-12T15:41:04.577137Z","published_at":"2026-08-12T15:14:47Z","references":["https://osv.dev/vulnerability/GHSA-5c4f-9pq9-6c77","https://github.com/wintercms/winter/security/advisories/GHSA-5c4f-9pq9-6c77","https://github.com/wintercms/winter","https://github.com/wintercms/winter/releases/tag/v1.2.13"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-5c4f-9pq9-6c77","url":"https://osv.dev/vulnerability/GHSA-5c4f-9pq9-6c77"}],"summary":"Winter: Broken access control in `Cms\\Controllers\\Index` allows cross-template actions and unauthorized asset uploads"}