CVE-2026-126061

Winter CMS is a content management system built on the Laravel PHP framework. From 1.2.13 until 1.2.14, the BackendControllersMyAccount controller inherits the FormController actions create, update, and preview while declaring an empty $requiredPermissions array, and formFindModelObject() resolves a caller-supplied record identifier through an unscoped BackendModelsUser query. Any authenticated backend user can request another sequential user identifier through /backend/backend/myaccount/preview/{other_user_id} or the inherited update action and read profile data including name, login, email, avatar, role, group membership, superuser status, and throttle state. Password material is not exposed, and existing model authorization guards block cross-user writes. This issue is fixed in version 1.2.14.