CVE-2026-75419

GoWind (go-wind-cms) versions before 1.0.0 ship with a broken authorization layer: the NewAuthorizer() function in both app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op engine (noop.State{}), so the authz middleware always permits every request. As a result, any user who can authenticate to the system — regardless of assigned role or tenant — can invoke administrative APIs directly, including endpoints for deleting users, resetting passwords, and creating tenants. An attacker with a low-privileged account can therefore tamper with or delete other accounts, potentially seize higher-privileged accounts via password reset, create unauthorized tenants, and disrupt service across tenant boundaries, yielding the high confidentiality, integrity, and availability impact reflected in the 8.8 CVSS score. All GoWind deployments running any version before 1.0.0 are affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently estimates the 30-day exploitation probability at roughly 0.3%.

What to do: Upgrade GoWind to version 1.0.0 or later, which replaces the no-op authorizer with a functioning authorization engine. Until patched, restrict the admin and app API endpoints to trusted networks or administrative users only, and audit users, passwords, and tenant records for unauthorized deletions, resets, or creations. Review authentication and API logs for administrative calls made by non-admin accounts, and reset any credentials that may have been altered.