CVE-2026-64662 in Statamic
Summary
by MITRE • 08/07/2026
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from entries they did not have permission to view, including entry content and custom field values, from any collection and including unpublished entries, through the navigation endpoint, though no data could be modified. This issue is fixed in versions 5.74.1 and 6.24.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability represents a critical access control flaw in Statamic CMS that allows authenticated users to bypass permission restrictions and access content they should not be authorized to view. The issue stems from insufficient authorization checks within the navigation endpoint, which serves as a gateway for retrieving content structure and metadata. An attacker with valid login credentials can exploit this weakness to enumerate and access entries from any collection regardless of their assigned permissions, including unpublished content that would normally remain hidden from unauthorized users.
The technical nature of this vulnerability aligns with CWE-285, which addresses improper authorization in software systems. This flaw specifically manifests as an authorization bypass where the navigation endpoint fails to properly validate user permissions before returning content references and metadata. The vulnerability affects both Statamic 5.x and 6.x branches, indicating it was likely introduced in a core permission handling component that spans multiple versions. Attackers can leverage this weakness to gather sensitive information about unpublished entries, custom field values, and overall content structure without being able to modify or delete any data.
The operational impact of this vulnerability is significant as it enables information disclosure attacks that could expose confidential content, unpublished drafts, or sensitive metadata that should remain restricted. This weakness particularly affects organizations relying on Statamic for managing sensitive content where unauthorized access to unpublished entries could lead to competitive intelligence leaks or compliance violations. The vulnerability's persistence across both major version lines suggests a fundamental flaw in the permission model implementation rather than a simple configuration issue.
Organizations using Statamic CMS should immediately upgrade to versions 5.74.1 or 6.24.0 to remediate this access control bypass vulnerability. Additionally, administrators should review existing user permissions and implement least privilege principles to minimize potential damage from compromised accounts. The fix addresses the root cause by strengthening authorization checks within the navigation endpoint to properly validate user permissions before returning content references. Security teams should also monitor for any unusual access patterns or enumeration attempts that might indicate exploitation of this vulnerability in the wild, as this type of information disclosure can serve as a precursor to more serious attacks targeting sensitive content or system architecture details.
This vulnerability demonstrates the critical importance of proper access control implementation in web applications and aligns with ATT&CK technique T1213, which covers data from information repositories. The flaw represents a classic case where insufficient input validation and authorization checking allowed privilege escalation through legitimate application interfaces. Organizations should conduct comprehensive security reviews of their content management systems to identify similar authorization bypass vulnerabilities that could expose sensitive data or system information to unauthorized users who have gained valid credentials through other means.