CVE-2026-75419: High severity GoWind go-wind-cms vulnerability
go-wind-cms (GoWind) before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer() function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine (noop.State{}), so the authz middleware always allows requests. Any authenticated user (regardless of role or tenant) can invoke administrative APIs such as deleting users, resetting passwords, and creating tenants.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated GoWind user can exploit it, including users whose assigned role or tenant should not permit access to the targeted administrative function. No user interaction is required.
Which actions could an unauthorized authenticated user perform?
The affected authorization middleware allows administrative API requests that should be restricted by role or tenant. Examples given include deleting users, resetting passwords, and creating tenants.
Are deployments affected by configuration, or is this an application-code issue?
The issue is caused by NewAuthorizer() returning a no-op authorization engine, causing the authorization middleware to allow requests. The provided data does not identify a configuration-based workaround or an unaffected default configuration.
What versions are affected?
GoWind go-wind-cms versions before 1.0.0 are affected. The provided data does not specify a fixed release version beyond that boundary.