{"id":"CVE-2026-75419","details":"go-wind-cms (GoWind) before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer() function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine (noop.State{}), so the authz middleware always allows requests. Any authenticated user (regardless of role or tenant) can invoke administrative APIs such as deleting users, resetting passwords, and creating tenants.","modified":"2026-10-11T10:45:28.172940949Z","published":"2026-08-27T00:00:00Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75419.json","cna_assigner":"mitre"},"references":[{"type":"WEB","url":"https://github.com/TKar0/TKar0-CvePoc/tree/main/2026-CVE-POC/CVE-2026-75419"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75419.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75419"},{"type":"REPORT","url":"https://github.com/tx7do/go-wind-cms/issues/23"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/tx7do/go-wind-cms","events":[{"introduced":"0"},{"fixed":"7c4687dce2ffe8e5980411a50695956842bc9cd3"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.0.0"}],"source":"DESCRIPTION"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-75419.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N"}]}