CVE-2026-49288

Deferred Deferred - Pending Action

Information Disclosure in Statamic CMS

Publication date: 2026-06-19

Last updated on: 2026-06-22

Assigner: GitHub, Inc.

Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Control Panel user could view metadata and content for resources they don't have permission to view, including entries, assets, users, roles, groups, and other configured resources. Depending on the resource, this could expose titles, custom field values, entry content, asset metadata, and the existence of users, roles, and groups. No data could be modified. This has been fixed in 5.73.23 and 6.20.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-19

Last Modified

2026-06-22

Generated

2026-07-11

AI Q&A

2026-06-19

EPSS Evaluated

2026-07-10

NVD

CVE-2026-49288

EUVD

EUVD-2026-38059

Affected Vendors & Products

Vendor	Product	Version / Range
statamic	cms	to 5.73.23\|end_excluding=6.20.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is a missing authorization issue in the Control Panel fieldtype endpoints of Statamic CMS. It allows an authenticated user to view metadata and content of resources they do not have permission to access. These resources include entries, assets, users, roles, groups, and other configured resources.

The exposed information can include titles, custom field values, entry content, asset metadata, and the existence of users, roles, and groups. However, no data modification is possible through this vulnerability.

The issue affects Statamic CMS versions prior to 5.73.23 and 6.20.0, where the fix has been applied.

Impact Analysis

This vulnerability can impact you by exposing sensitive information that you may expect to be restricted. An authenticated user with low privileges can access metadata and content of restricted resources without proper authorization.

The exposed data includes titles, custom field values, entry content, asset metadata, and information about users, roles, and groups. This could lead to information disclosure risks, potentially aiding attackers or unauthorized users in gathering intelligence about your system.

However, the vulnerability does not allow modification or deletion of data, limiting the impact to information exposure only.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Statamic CMS to version 5.73.23 or later, or 6.20.0 or later, as these versions contain the fix for the missing authorization issue.

Ensure that only authenticated users with appropriate permissions have access to the Control Panel to reduce exposure risk.

Compliance Impact

This vulnerability allows authenticated users to view metadata and content of restricted resources they do not have permission to access, potentially exposing sensitive information such as titles, custom field values, entry content, asset metadata, and the existence of users, roles, and groups.

Such unauthorized exposure of sensitive information could lead to non-compliance with data protection regulations and standards like GDPR and HIPAA, which require strict access controls and protection of personal and sensitive data.

However, no data modification is possible through this vulnerability.

Hi! I’m here to help you understand CVE-2026-49288. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70