PT-2026-26205 · Statamic · Statamic

Everythingblackkk · Published 2026-03-18 · Updated 2026-03-21 · CVE-2026-33177

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.73.14 Statamic versions prior to 6.7.0

Description Low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action processing endpoint with attacker-controlled field definitions. This bypasses the authorization checks enforced on the standard taxonomy term creation endpoint. The vulnerable endpoint is /cp/field/action. The issue involves manipulating field definitions to bypass authorization controls.

Recommendations Update to Statamic version 5.73.14 or later. Update to Statamic version 6.7.0 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-33177

GHSA-WH3H-GVC4-CC2G

Affected Products

Statamic

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33177.json · Exploit
• https://github.com/statamic/cms/security/advisories/GHSA-wh3h-gvc4-cc2g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33177 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33177 · Security Note
• https://osv.dev/vulnerability/GHSA-wh3h-gvc4-cc2g · Vendor Advisory
• https://github.com/statamic/cms · Note
• https://twitter.com/0xblackkk/status/2034955592221995497 · Twitter Post
• https://twitter.com/CVEnew/status/2035262145236009436 · Twitter Post