Vulnerability · Published Mar 27, 2026 · Assigned by GitHub_M
CVE-2026-33887Statamic allows unauthorized content access through missing authorization in its revision controllers
Medium 5.4
In plain English
A medium-severity missing authorization in cms from statamic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, authenticated Control Panel users could view entry revisions for any collection with revisions enabled, regardless of whether they had the required collection permissions. This bypasses the authorization checks that the main entry controllers enforce, exposing entry field values and blueprint data. Users could also create entry revisions without edit permission, though this only snapshots the existing content state and does not affect published content. This has been fixed in 5.73.16 and 6.7.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | statamic/cms | 5.73.16 | GHSA-4hp7-3wxg-cv9q |
| Packagist | statamic/cms | 6.7.2 | GHSA-4hp7-3wxg-cv9q |
Affected products (as reported)
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
References
- https://github.com/statamic/cms/security/advisories/GHSA-4hp7-3wxg-cv9q x_refsource_CONFIRM