CVE-2026-33887

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, authenticated Control Panel users could view entry revisions for any collection with revisions enabled, regardless of whether they had the required collection permissions. This bypasses the authorization checks that the main entry controllers enforce, exposing entry field values and blueprint data. Users could also create entry revisions without edit permission, though this only snapshots the existing content state and does not affect published content. This has been fixed in 5.73.16 and 6.7.2.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/statamic/cms/security/advisories/GHSA-4hp7-3wxg-cv9q	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:statamic:statamic::::::::
	cpe:2.3:a:statamic:statamic::::::::

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Statamic es un sistema de gestión de contenido (CMS) impulsado por Laravel y Git. Antes de las versiones 5.73.16 y 6.7.2, los usuarios autenticados del Panel de Control podían ver las revisiones de entradas para cualquier colección con revisiones habilitadas, independientemente de si tenían los permisos de colección requeridos. Esto elude las comprobaciones de autorización que los controladores de entrada principales aplican, exponiendo los valores de los campos de entrada y los datos de esquema. Los usuarios también podían crear revisiones de entradas sin permiso de edición, aunque esto solo captura el estado del contenido existente y no afecta al contenido publicado. Esto ha sido corregido en 5.73.16 y 6.7.2.

Information

Published : 2026-03-27 21:17

Updated : 2026-10-26 21:10

NVD link : CVE-2026-33887

Mitre link : CVE-2026-33887

CVE.ORG link : CVE-2026-33887

JSON object : View

Products Affected

statamic

statamic

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-33887", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33887", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-30T18:54:14.725865Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "statamic", "product": "cms", "versions": [{"status": "affected", "version": "< 5.73.16"}, {"status": "affected", "version": ">= 6.0.0-alpha.1, < 6.7.2"}]}]}], "published": "2026-03-27T21:17:25.647", "references": [{"url": "https://github.com/statamic/cms/security/advisories/GHSA-4hp7-3wxg-cv9q", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, authenticated Control Panel users could view entry revisions for any collection with revisions enabled, regardless of whether they had the required collection permissions. This bypasses the authorization checks that the main entry controllers enforce, exposing entry field values and blueprint data. Users could also create entry revisions without edit permission, though this only snapshots the existing content state and does not affect published content. This has been fixed in 5.73.16 and 6.7.2."}, {"lang": "es", "value": "Statamic es un sistema de gesti\u00f3n de contenido (CMS) impulsado por Laravel y Git. Antes de las versiones 5.73.16 y 6.7.2, los usuarios autenticados del Panel de Control pod\u00edan ver las revisiones de entradas para cualquier colecci\u00f3n con revisiones habilitadas, independientemente de si ten\u00edan los permisos de colecci\u00f3n requeridos. Esto elude las comprobaciones de autorizaci\u00f3n que los controladores de entrada principales aplican, exponiendo los valores de los campos de entrada y los datos de esquema. Los usuarios tambi\u00e9n pod\u00edan crear revisiones de entradas sin permiso de edici\u00f3n, aunque esto solo captura el estado del contenido existente y no afecta al contenido publicado. Esto ha sido corregido en 5.73.16 y 6.7.2."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EACDC143-742E-4926-9C28-6095690EB549", "versionEndExcluding": "5.73.16"}, {"criteria": "cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "631FF065-0872-4DC7-AB25-AB74B782A9BE", "versionEndExcluding": "6.7.2", "versionStartIncluding": "6.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}