CVE-2026-49288

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Control Panel user could view metadata and content for resources they don't have permission to view, including entries, assets, users, roles, groups, and other configured resources. Depending on the resource, this could expose titles, custom field values, entry content, asset metadata, and the existence of users, roles, and groups. No data could be modified. This has been fixed in 5.73.23 and 6.20.0.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/statamic/cms/security/advisories/GHSA-2497-6pwj-pwg7

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Statamic es un sistema de gestión de contenido (CMS) impulsado por Laravel y Git. Antes de 5.73.23 y 6.20.0, un usuario autenticado del Panel de Control podía ver metadatos y contenido de recursos para los que no tenía permiso de visualización, incluyendo entradas, activos, usuarios, roles, grupos y otros recursos configurados. Dependiendo del recurso, esto podría exponer títulos, valores de campos personalizados, contenido de las entradas, metadatos de los activos y la existencia de usuarios, roles y grupos. Ningún dato podía ser modificado. Esto ha sido corregido en 5.73.23 y 6.20.0.

Information

Published : 2026-06-19 19:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-49288

Mitre link : CVE-2026-49288

CVE.ORG link : CVE-2026-49288

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-862

Missing Authorization

CWE-863

Incorrect Authorization

{"id": "CVE-2026-49288", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49288", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T17:51:28.129379Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "statamic", "product": "cms", "versions": [{"status": "affected", "version": "< 5.73.23"}, {"status": "affected", "version": ">= 6.0.0, < 6.20.0"}]}]}], "published": "2026-06-19T19:16:36.040", "references": [{"url": "https://github.com/statamic/cms/security/advisories/GHSA-2497-6pwj-pwg7", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-862"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Control Panel user could view metadata and content for resources they don't have permission to view, including entries, assets, users, roles, groups, and other configured resources. Depending on the resource, this could expose titles, custom field values, entry content, asset metadata, and the existence of users, roles, and groups. No data could be modified. This has been fixed in 5.73.23 and 6.20.0."}, {"lang": "es", "value": "Statamic es un sistema de gesti\u00f3n de contenido (CMS) impulsado por Laravel y Git. Antes de 5.73.23 y 6.20.0, un usuario autenticado del Panel de Control pod\u00eda ver metadatos y contenido de recursos para los que no ten\u00eda permiso de visualizaci\u00f3n, incluyendo entradas, activos, usuarios, roles, grupos y otros recursos configurados. Dependiendo del recurso, esto podr\u00eda exponer t\u00edtulos, valores de campos personalizados, contenido de las entradas, metadatos de los activos y la existencia de usuarios, roles y grupos. Ning\u00fan dato pod\u00eda ser modificado. Esto ha sido corregido en 5.73.23 y 6.20.0."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "security-advisories@github.com"}