Authorization Bypass Through User-Controlled Key Affecting winter/wn-backend-module package, versions <1.2.13
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Authorization Bypass Through User-Controlled Key vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PHP-WINTERWNBACKENDMODULE-18689668
- published12 Aug 2026
- disclosed12 Aug 2026
- creditUnknown
Introduced: 12 Aug 2026
NewCVE-2026-35445 (opens in a new tab)How to fix?
Upgrade winter/wn-backend-module to version 1.2.13 or higher.
Overview
Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the process that handles backend controller method dispatching via the _handler POST field. An attacker can execute unauthorized controller methods by submitting crafted POST requests with arbitrary handler names, potentially modifying or deleting user records without proper permission checks. This is only exploitable if the attacker is an authenticated backend user with a valid session.
Workaround
This vulnerability can be mitigated by validating the _handler POST field against the on[A-Z][\w+]* pattern in modules/backend/classes/Controller.php and removing the conditional that sets $requiredPermissions to null for the myaccount action in modules/backend/controllers/Users.php.