PT-2026-34571 · Statamic · Statamic

Joshuaalwin + 1 · Published 2026-04-16 · Updated 2026-04-23 · CVE-2026-41175

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.73.20 Statamic versions prior to 6.13.0

Description Manipulating query parameters on Control Panel and REST API endpoints, or arguments in GraphQL queries, can lead to the loss of content, assets, and user accounts. Exploitation via the Control Panel requires authentication with minimal permissions, such as the "view entries" permission to delete entries or the "view users" permission to delete users. Exploits targeting the REST and GraphQL APIs do not require permissions, but these APIs are not enabled by default; they must be explicitly enabled without authentication and with specific resources accessible to be exploited.

Recommendations Update to version 5.73.20 Update to version 6.13.0

Fix

Weakness Enumeration

CWE-470

Related Identifiers

CVE-2026-41175

GHSA-4JJR-VMV7-WH4W

Affected Products

Statamic

References · 5

• https://github.com/statamic/cms/security/advisories/GHSA-4jjr-vmv7-wh4w · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4jjr-vmv7-wh4w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41175 · Security Note
• https://github.com/statamic/cms · Note
• https://twitter.com/CVEnew/status/2047359931477573947 · Twitter Post