PT-2026-28551 · Statamic · Statamic

Published 2026-03-26 · Updated 2026-03-28 · CVE-2026-33884

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.73.16 Statamic versions prior to 6.7.2

Description An authenticated Control Panel user with access to live preview could use a live preview token to access restricted content that the token was not intended for. This issue affects the content management system (CMS) and potentially impacts users with access to the Control Panel and live preview functionality.

Recommendations Update to Statamic version 5.73.16 or later. Update to Statamic version 6.7.2 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-33884

GHSA-8VWX-CCF6-5WG2

Affected Products

Statamic

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33884.json · Exploit
• https://github.com/statamic/cms/security/advisories/GHSA-8vwx-ccf6-5wg2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33884 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33884 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8vwx-ccf6-5wg2 · Vendor Advisory
• https://github.com/statamic/cms · Note
• https://twitter.com/CVEnew/status/2037719391190798597 · Twitter Post