GitHub Advisoryadvisory · Packagist

GHSA-2497-6pwj-pwg7 Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources

MEDIUM Published 2026-06-26 Modified 2026-06-26 Official page ↗
Aliases
CVE-2026-49288
Ecosystem
Packagist
Packages
statamic/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-862, CWE-863
Reviewed
2026-06-26

Affected packages

• Packagist statamic/cms: < 5.73.23 → fixed in 5.73.23 • Packagist statamic/cms: >= 6.0.0, < 6.20.0 → fixed in 6.20.0

Description

Impact An authenticated Control Panel user could view metadata and content for resources they don't have permission to view, including entries, assets, users, roles, groups, and other configured resources. Depending on the resource, this could expose titles, custom field values, entry content, asset metadata, and the existence of users, roles, and groups. No data could be modified. Patches This has been fixed in 5.73.23 and 6.20.0.

Related

Alias · CVE (1)

  • CVE-2026-49288 Statamic is a Laravel and Git powered content management system (CMS). vulnerability

Weakness · CWE (3)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-862 Missing Authorization weakness
  • CWE-863 Incorrect Authorization weakness

References