[MEDIUM] Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata

PKSA-dbvq-twhc-nj83 CVE-2026-54256 GHSA-3277-h8g9-qj5f

Affected package: winter/wn-backend-module

Affected version: <=1.2.12

Reported by:
GitHub