Statamic is missing authorization check on taxonomy term creation via fieldtype

Vulnerability

Overview

CVE-2026-33177 is an authorization bypass vulnerability in Statamic, a Laravel and Git powered CMS. Prior to versions 5.73.14 and 6.0 and 6.7.0, the field action processing endpoint did not properly verify that the requesting user had permission to create taxonomy terms. By submitting crafted requests with attacker-controlled field definitions, low-privileged Control Panel users could bypass the authorization checks enforced on the standard taxonomy term creation endpoint [1][3].

Exploitation

An attacker must have a valid Control Panel user account with low privileges. No special network position is required beyond access to the Control Panel. The attack is performed by sending a specially crafted request to the field action processing endpoint, including arbitrary field definitions that the endpoint would process without verifying the user's authorization to create taxonomy terms [1][3].

Impact

Successful exploitation allows an attacker to create taxonomy terms that they would not normally be permitted to create. This could lead to unauthorized content manipulation within the CMS, potentially affecting the integrity of the site's taxonomy structure [1][3].

Mitigation

The vulnerability has been fixed in Statamic versions 5.73.14.0 and 6.7.0. Users running earlier versions should upgrade immediately to one of the patched releases [1][3].