GitHub Advisoryadvisory · Packagist

GHSA-gwmx-9gcj-332h Statamic CMS's missing authorization allows access to assets

MEDIUM Published 2026-02-11 Modified 2026-02-11 Official page ↗
Aliases
CVE-2026-25633
Ecosystem
Packagist
Packages
statamic/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-862
Reviewed
2026-02-11

Affected packages

• Packagist statamic/cms: < 5.73.6 → fixed in 5.73.6 • Packagist statamic/cms: >= 6.0.0-alpha.1, < 6.2.5 → fixed in 6.2.5

Description

Impact Users without permission to view assets are able are able to download them and view their metadata. Logged-out users and users without permission to access the control panel are unable to take advantage of this. Patches This has been fixed in 5.73.6 and 6.2.5.

Related

Alias · CVE (1)

  • CVE-2026-25633 Statamic is a, Laravel + Git powered CMS designed for building websites. vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References