GitHub Advisoryadvisory · Packagist

GHSA-7mqq-4v55-88gh Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors

LOW Published 2026-06-26 Modified 2026-06-26 Official page ↗
Aliases
CVE-2026-54244
Ecosystem
Packagist
Packages
statamic/cms
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-863
Reviewed
2026-06-26

Affected packages

• Packagist statamic/cms: < 5.74.0 → fixed in 5.74.0 • Packagist statamic/cms: >= 6.0.0, < 6.20.3 → fixed in 6.20.3

Description

Impact The Live Preview endpoint for existing entries and terms only checked view authorization, but it accepts and renders caller-supplied field values. A Control Panel user with view but not edit permission could therefore submit content they were not authorized to author and generate a shareable Live Preview URL rendering it. Patches This has been fixed in 5.74.0 and 6.20.3.

Related

Alias · CVE (1)

  • CVE-2026-54244 Statamic is a Laravel and Git powered content management system (CMS). vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References