go-wind-cms (GoWind) before version 1.0.0 contains a critical missing authorization vulnerability. The NewAuthorizer() function in two data.go files returns a no-op authorization engine (noop.State{}), effectively disabling authorization checks entirely. As a result, the authz middleware allows all requests without proper role or permission validation. Any authenticated user, regardless of their role or tenant membership, can access and invoke administrative APIs. Exposed administrative functions include deleting users, resetting passwords, and creating tenants. This represents a broken access control issue where authentication exists but authorization is completely bypassed. A proof-of-concept exploit has been published on GitHub, increasing the risk of active exploitation.
