The go-wind-cms platform contains a critical authorization bypass flaw that enables any authenticated user to perform administrative operations, posing a severe risk to system integrity.

The application utilizes a no-op authorization engine within the NewAuthorizer function, which causes the authorization middleware to fail and permit all requests. Any authenticated user, regardless of their assigned role or tenant, can successfully invoke sensitive administrative APIs.

This vulnerability carries a high CVSS score of 8.8, reflecting the significant potential for unauthorized administrative access. A successful exploit could lead to complete account takeovers, unauthorized data deletion, and full compromise of the application environment, resulting in significant operational disruption and loss of confidentiality and integrity.

Immediate Action: Update go-wind-cms to version 1.0.0 or later immediately to resolve the authorization middleware defect.

Proactive Monitoring: Review system and application logs for suspicious administrative API calls originating from non-administrative user accounts.

Compensating Controls: Implement strict network-level access controls to limit access to administrative endpoints, or utilize a Web Application Firewall to block unauthorized attempts to invoke sensitive administrative functions.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the TKar0-CvePoc repository.

Given the high severity of this authorization bypass and the public availability of exploit material, organizations must prioritize upgrading to version 1.0.0. Failure to patch this vulnerability leaves the environment exposed to trivial escalation of privilege attacks by any user with valid system credentials.