In short
- CVE-2026-33887 is a MEDIUM (CVSS 5.4) vulnerability affecting statamic/cms, statamic (statamic).
- Chance of exploitation in the next 30 days (EPSS): 0.15%, higher than 3.9% of all vulnerabilities.
- Fix: update to 6.7.2, 5.73.16 or later.
| Package | Affected versions | Patched versions |
|---|
| statamic/cms Packagist | ≥ 6.0.0-alpha.1, < 6.7.2< 5.73.16
| 6.7.25.73.16
|
| statamic | ≥ 6.0.0, < 6.7.2< 5.73.16
| 6.7.25.73.16
|
Description
Impact
Authenticated Control Panel users could view entry revisions for any collection with revisions enabled, regardless of whether they had the required collection permissions. This bypasses the authorization checks that the main entry controllers enforce, exposing entry field values and blueprint data.
Users could also create entry revisions without edit permission, though this only snapshots the existing content state and does not affect published content.
Patches
This has been fixed in 5.73.16 and 6.7.2.
NVD description
Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, authenticated Control Panel users could view entry revisions for any collection with revisions enabled, regardless of whether they had the required collection permissions. This bypasses the authorization checks that the main entry controllers enforce, exposing entry field values and blueprint data. Users could also create entry revisions without edit permission, though this only snapshots the existing content state and does not affect published content. This has been fixed in 5.73.16 and 6.7.2.
More vulnerabilities in statamic/cms
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free