PT-2026-28551 · Statamic · Statamic

Publicado 2026-03-26 · Atualizado 2026-03-28 · CVE-2026-33884

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.73.16 Statamic versions prior to 6.7.2

Description An authenticated Control Panel user with access to live preview could use a live preview token to access restricted content that the token was not intended for. This issue affects the content management system (CMS) and potentially impacts users with access to the Control Panel and live preview functionality.

Recommendations Update to Statamic version 5.73.16 or later. Update to Statamic version 6.7.2 or later.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-33884

GHSA-8VWX-CCF6-5WG2

Produtos afetados

Statamic

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33884.json · Exploit
• https://github.com/statamic/cms · Nota
• https://github.com/statamic/cms/security/advisories/GHSA-8vwx-ccf6-5wg2 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2037719391190798597 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-33884 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-33884 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-8vwx-ccf6-5wg2 · Aviso do Fabricante