CVE-2026-33887 in Statamic CMS

Resumen (Inglés)

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, authenticated Control Panel users could view entry revisions for any collection with revisions enabled, regardless of whether they had the required collection permissions. This bypasses the authorization checks that the main entry controllers enforce, exposing entry field values and blueprint data. Users could also create entry revisions without edit permission, though this only snapshots the existing content state and does not affect published content. This has been fixed in 5.73.16 and 6.7.2.

Responsable

GitHub_M

Reservar

2026-03-24

Divulgación

2026-03-27

Voces

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidad	CWE	Exp	Con	CVE
354037	Statamic CMS Edit Permission escalada de privilegios	862	No está definido	Arreglo oficial	CVE-2026-33887