PT-2026-26205 · Statamic · Statamic

Everythingblackkk · Publicado 2026-03-18 · Atualizado 2026-03-21 · CVE-2026-33177

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.73.14 Statamic versions prior to 6.7.0

Description Low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action processing endpoint with attacker-controlled field definitions. This bypasses the authorization checks enforced on the standard taxonomy term creation endpoint. The vulnerable endpoint is /cp/field/action. The issue involves manipulating field definitions to bypass authorization controls.

Recommendations Update to Statamic version 5.73.14 or later. Update to Statamic version 6.7.0 or later.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-33177

GHSA-WH3H-GVC4-CC2G

Produtos afetados

Statamic

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33177.json · Exploit
• https://github.com/statamic/cms · Nota
• https://github.com/statamic/cms/security/advisories/GHSA-wh3h-gvc4-cc2g · Aviso do Fabricante
• https://twitter.com/0xblackkk/status/2034955592221995497 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2035262145236009436 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-33177 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33177 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-wh3h-gvc4-cc2g · Aviso do Fabricante