What is GHSA-78vq-rgm7-m986?

GHSA-78vq-rgm7-m986 is a security advisory published by GitHub Security Advisories with High severity. go-wind-cms (GoWind) before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer()...

Which CVE IDs does GHSA-78vq-rgm7-m986 cover?

GHSA-78vq-rgm7-m986 covers the following CVE IDs: CVE-2026-75419. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-78vq-rgm7-m986?

GHSA-78vq-rgm7-m986 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-78vq-rgm7-m986HighCVSS 8.8

go-wind-cms (GoWind) before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer()...

Vendor

GitHub Security Advisories

Published

August 28, 2026

Last Modified

August 28, 2026

🔗 CVE IDs covered (1)

CVE-2026-75419 →

📋 Description

go-wind-cms (GoWind) before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer() function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine (noop.State{}), so the authz middleware always allows requests. Any authenticated user (regardless of role or tenant) can invoke administrative APIs such as deleting users, resetting passwords, and creating tenants.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-75419
https://github.com/tx7do/go-wind-cms/issues/23
https://github.com/TKar0/TKar0-CvePoc/tree/main/2026-CVE-POC/CVE-2026-75419
https://github.com/advisories/GHSA-78vq-rgm7-m986