GitHub Advisoryadvisory · Packagist

GHSA-qh8c-7588-qfrv Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries

MEDIUM Published 2026-08-06 Modified 2026-08-06 Official page ↗
Aliases
CVE-2026-64662
Ecosystem
Packagist
Packages
statamic/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-639, CWE-862
Reviewed
2026-08-06

Affected packages

• Packagist statamic/cms: < 5.74.1 → fixed in 5.74.1 • Packagist statamic/cms: >= 6.0.0, < 6.24.0 → fixed in 6.24.0

Description

Impact An authenticated Control Panel user could view content from entries they don't have permission to view, including entry content and custom field values, from any collection and including unpublished entries. No data could be modified. Patches This has been fixed in 5.74.1 and 6.24.0.

Related

Alias · CVE (1)

  • CVE-2026-64662 Statamic is a Laravel and Git powered content management system (CMS). vulnerability

Weakness · CWE (2)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness
  • CWE-862 Missing Authorization weakness

References