Unrated severityNVD Advisory· Published Jun 19, 2026
Statamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources
CVE-2026-49288
Description
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Control Panel user could view metadata and content for resources they don't have permission to view, including entries, assets, users, roles, groups, and other configured resources. Depending on the resource, this could expose titles, custom field values, entry content, asset metadata, and the existence of users, roles, and groups. No data could be modified. This has been fixed in 5.73.23 and 6.20.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- github.com/statamic/cms/security/advisories/GHSA-2497-6pwj-pwg7mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.