Statamic: privilege escalation via stored cross-site scripting

Vulnerability

CVE-2026-32612 is a stored cross-site scripting (XSS) in Statamic CMS prior to 6.6.2, specifically in the control panel's color mode preference mechanism. The root cause is that user-controlled preference data is stored without validation or encoding and later rendered unsafely into inline JavaScript using Blade output (e.g., {!! $userMode !!}), allowing an attacker to break out of the string context [1][2].

Exploitation

The attack requires an authenticated user with control panel access (low privileges). The attacker sets a malicious value for the color_mode preference. Exploitation occurs when a higher-privileged administrator uses Statamic's built-in user impersonation feature to view the attacker's account; the stored payload executes in the admin's browser session [2][4]. User interaction from the admin (the impersonation action) is required.

Impact

Successful exploitation allows arbitrary JavaScript execution in the context of the administrator's session. This can lead to privilege escalation, as the attacker-controlled script can perform actions on behalf of the admin, such as modifying site content, accessing sensitive data, or creating new privileged accounts [2][4].

Mitigation

The vendor has fixed this vulnerability in Statamic CMS version 6.6.2. Users should upgrade to that version or later. No workarounds are publicly detailed [1][4].