CVE-2026-54244

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in src/Http/Controllers/CP/PreviewController.php only checked view authorization, but it accepts and renders caller-supplied field values. A Control Panel user with view but not edit permission could therefore submit content they were not authorized to author and generate a shareable Live Preview URL rendering it. This issue is fixed in versions 5.74.0 and 6.20.3.

CVSS v3 3.5 LOW

3.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/statamic/cms/commit/87b9998f4d9e40de53346402ccf6eb3c17ba168f
https://github.com/statamic/cms/pull/14791
https://github.com/statamic/cms/releases/tag/v5.74.0
https://github.com/statamic/cms/releases/tag/v6.20.3
https://github.com/statamic/cms/security/advisories/GHSA-7mqq-4v55-88gh

Configurations

No configuration.

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Statamic es un sistema de gestión de contenido (CMS) impulsado por Laravel y Git. Antes de las versiones 5.74.0 y 6.20.3, el endpoint de Vista Previa en Vivo para entradas y términos existentes en src/HTTP/Controllers/CP/PreviewController.PHP solo verificaba la autorización de vista, pero acepta y renderiza valores de campo proporcionados por el llamador. Un usuario del Panel de Control con permiso de vista pero no de edición podría, por lo tanto, enviar contenido que no estaba autorizado a crear y generar una URL de Vista Previa en Vivo compartible que lo renderizara. Este problema está solucionado en las versiones 5.74.0 y 6.20.3.

Information

Published : 2026-07-17 21:17

Updated : 2026-10-24 20:10

NVD link : CVE-2026-54244

Mitre link : CVE-2026-54244

CVE.ORG link : CVE-2026-54244

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-54244", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54244", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T18:51:53.445479Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "statamic", "product": "cms", "versions": [{"status": "affected", "version": "< 5.74.0"}, {"status": "affected", "version": ">= 6.0.0, < 6.20.3"}]}]}], "published": "2026-07-17T21:17:08.523", "references": [{"url": "https://github.com/statamic/cms/commit/87b9998f4d9e40de53346402ccf6eb3c17ba168f", "source": "security-advisories@github.com"}, {"url": "https://github.com/statamic/cms/pull/14791", "source": "security-advisories@github.com"}, {"url": "https://github.com/statamic/cms/releases/tag/v5.74.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/statamic/cms/releases/tag/v6.20.3", "source": "security-advisories@github.com"}, {"url": "https://github.com/statamic/cms/security/advisories/GHSA-7mqq-4v55-88gh", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in src/Http/Controllers/CP/PreviewController.php only checked view authorization, but it accepts and renders caller-supplied field values. A Control Panel user with view but not edit permission could therefore submit content they were not authorized to author and generate a shareable Live Preview URL rendering it. This issue is fixed in versions 5.74.0 and 6.20.3."}, {"lang": "es", "value": "Statamic es un sistema de gesti\u00f3n de contenido (CMS) impulsado por Laravel y Git. Antes de las versiones 5.74.0 y 6.20.3, el endpoint de Vista Previa en Vivo para entradas y t\u00e9rminos existentes en src/HTTP/Controllers/CP/PreviewController.PHP solo verificaba la autorizaci\u00f3n de vista, pero acepta y renderiza valores de campo proporcionados por el llamador. Un usuario del Panel de Control con permiso de vista pero no de edici\u00f3n podr\u00eda, por lo tanto, enviar contenido que no estaba autorizado a crear y generar una URL de Vista Previa en Vivo compartible que lo renderizara. Este problema est\u00e1 solucionado en las versiones 5.74.0 y 6.20.3."}], "lastModified": "2026-10-24T20:10:00.137", "sourceIdentifier": "security-advisories@github.com"}