GitHub Advisoryadvisory · Packagist

GHSA-4hp7-3wxg-cv9q Statamic allows unauthorized content access through missing authorization in its revision controllers

MEDIUM Published 2026-03-26 Modified 2026-03-27 Official page ↗
Aliases
CVE-2026-33887
Ecosystem
Packagist
Packages
statamic/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-862
Reviewed
2026-03-26

Affected packages

• Packagist statamic/cms: < 5.73.16 → fixed in 5.73.16 • Packagist statamic/cms: >= 6.0.0-alpha.1, < 6.7.2 → fixed in 6.7.2

Description

Impact Authenticated Control Panel users could view entry revisions for any collection with revisions enabled, regardless of whether they had the required collection permissions. This bypasses the authorization checks that the main entry controllers enforce, exposing entry field values and blueprint data. Users could also create entry revisions without edit permission, though this only snapshots the existing content state and does not affect published content. Patches This has been fixed in 5.73.16 and 6.7.2.

Related

Alias · CVE (1)

  • CVE-2026-33887 Statamic is a Laravel and Git powered content management system (CMS). vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References