CVE-2026-54244

Received Received - Intake

Information Disclosure in Statamic CMS via Live Preview

Publication date: 2026-07-17

Last updated on: 2026-07-17

Assigner: GitHub, Inc.

Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in src/Http/Controllers/CP/PreviewController.php only checked view authorization, but it accepts and renders caller-supplied field values. A Control Panel user with view but not edit permission could therefore submit content they were not authorized to author and generate a shareable Live Preview URL rendering it. This issue is fixed in versions 5.74.0 and 6.20.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-17

Last Modified

2026-07-17

Generated

2026-07-18

AI Q&A

2026-07-18

EPSS Evaluated

N/A

NVD

CVE-2026-54244

Affected Vendors & Products

Vendor	Product	Version / Range
statamic	statamic	to 5.74.0 (exc)
statamic	statamic	to 6.20.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability affects Statamic, a Laravel and Git powered CMS. It allows a user with view but not edit permissions to submit unauthorized content via the Live Preview endpoint. The system only checks view authorization but renders user-supplied field values, creating a shareable preview URL for the unauthorized content.

Detection Guidance

To detect this vulnerability, check if your Statamic installation is running a version prior to 5.74.0 or 6.20.3. Use commands like 'composer show statamic/statamic' or check the version in the Statamic control panel. If vulnerable, update immediately to a patched version.

Impact Analysis

An attacker with limited access could publish or preview content they are not authorized to create. This may lead to unauthorized information disclosure or content manipulation within the CMS, potentially affecting data integrity and confidentiality.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or modification, violating GDPR's data integrity and confidentiality principles or HIPAA's access control requirements. Organizations using affected Statamic versions may face compliance risks due to potential unauthorized content access.

Mitigation Strategies

Upgrade Statamic to version 5.74.0 or 6.20.3 or later to address the vulnerability. Ensure users have appropriate permissions and review access controls for the Live Preview feature.

Hi! I’m here to help you understand CVE-2026-54244. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70