GitHub Advisoryadvisory · Packagist

GHSA-wh3h-gvc4-cc2g Statamic is missing authorization check on taxonomy term creation via fieldtype

MEDIUM Published 2026-03-18 Modified 2026-03-25 Official page ↗
Aliases
CVE-2026-33177
Ecosystem
Packagist
Packages
statamic/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-862
Reviewed
2026-03-18

Affected packages

• Packagist statamic/cms: >= 6.0.0-alpha.1, < 6.7.0 → fixed in 6.7.0 • Packagist statamic/cms: < 5.73.14 → fixed in 5.73.14

Description

Impact Low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action processing endpoint with attacker-controlled field definitions. This bypasses the authorization checks enforced on the standard taxonomy term creation endpoint. Patches This has been fixed in 5.73.14 and 6.7.0.

Related

Alias · CVE (1)

  • CVE-2026-33177 Statamic is a Laravel and Git powered content management system (CMS). vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References