GitHub Advisoryadvisory · Packagist

GHSA-cvh3-23vq-w7h4 Statamic's Markdown preview endpoint exposes sensitive user data

MEDIUM Published 2026-03-26 Modified 2026-03-27 Official page ↗
Aliases
CVE-2026-33882
Ecosystem
Packagist
Packages
statamic/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-20, CWE-200
Reviewed
2026-03-26

Affected packages

• Packagist statamic/cms: < 5.73.16 → fixed in 5.73.16 • Packagist statamic/cms: >= 6.0.0-alpha.1, < 6.7.2 → fixed in 6.7.2

Description

Impact The markdown preview endpoint could be manipulated to return augmented data from arbitrary fieldtypes. With the users fieldtype specifically, an authenticated control panel user could retrieve sensitive user data including email addresses, encrypted passkey data, and encrypted two-factor authentication codes. Patches This has been fixed in 5.73.16 and 6.7.2.

Related

Alias · CVE (1)

  • CVE-2026-33882 Statamic is a Laravel and Git powered content management system (CMS). vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References