Medium severity4.3NVD Advisory· Published Jun 19, 2026· Updated Jun 23, 2026
CVE-2026-49288
CVE-2026-49288
Description
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Control Panel user could view metadata and content for resources they don't have permission to view, including entries, assets, users, roles, groups, and other configured resources. Depending on the resource, this could expose titles, custom field values, entry content, asset metadata, and the existence of users, roles, and groups. No data could be modified. This has been fixed in 5.73.23 and 6.20.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
statamic/cmsPackagist | < 5.73.23 | 5.73.23 |
statamic/cmsPackagist | >= 6.0.0, < 6.20.0 | 6.20.0 |
Affected products
1Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.