PT-2026-22406 · Statmatic · Statmatic

Mistz1 · Published 2026-02-27 · Updated 2026-03-10 · CVE-2026-27939

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Statmatic versions 6.0.0 through 6.3.9

Description Statmatic is a Laravel and Git powered content management system (CMS). Authenticated Control Panel users may, under certain conditions, obtain elevated privileges without completing the intended verification step. This can allow access to sensitive operations and potentially lead to privilege escalation, depending on the user’s existing permissions.

Recommendations Statmatic versions 6.0.0 through 6.3.9 should be updated to version 6.4.0.

Exploit

Fix

LPE

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-27939

GHSA-RW9X-PXQX-Q789

Affected Products

Statmatic

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27939.json · Exploit
• https://github.com/statamic/cms/commit/8639ef96217eaa682bc42e8a62769cb7c6a85d3a · Patch
• https://github.com/statamic/cms/security/advisories/GHSA-rw9x-pxqx-q789 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27939 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27939 · Security Note
• https://osv.dev/vulnerability/GHSA-rw9x-pxqx-q789 · Vendor Advisory
• https://github.com/statamic/cms · Note
• https://twitter.com/CVEnew/status/2027744229364019592 · Twitter Post
• https://twitter.com/TheHackerWire/status/2027531976211837244 · Twitter Post
• https://t.me/cveNotify/154917 · Telegram Post
• https://t.me/CVEtracker/46016 · Telegram Post
• https://twitter.com/_cvereports/status/2027536773719486684 · Twitter Post
• https://twitter.com/pulsepatchio/status/2028115273828516327 · Twitter Post
• https://t.me/cveNotify/153590 · Telegram Post
• https://twitter.com/CveFindCom/status/2027514416107766091 · Twitter Post