PT-2026-53029 · Packagist · Statamic Cms

Publicado 2026-06-26 · Atualizado 2026-06-26 · CVE-2026-54244

OSV

CVSS v3.1

3.5

Baixa

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Impact

The Live Preview endpoint for existing entries and terms only checked view authorization, but it accepts and renders caller-supplied field values. A Control Panel user with view but not edit permission could therefore submit content they were not authorized to author and generate a shareable Live Preview URL rendering it.

Patches

This has been fixed in 5.74.0 and 6.20.3.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-54244

GHSA-7MQQ-4V55-88GH

Produtos afetados

Statamic Cms

Referências · 3

• https://github.com/statamic/cms/security/advisories/GHSA-7mqq-4v55-88gh · Nota
• https://github.com/statamic/cms · Nota
• https://osv.dev/vulnerability/GHSA-7mqq-4v55-88gh · Aviso do Fabricante