Statamic is missing authorization check on taxonomy term creation via fieldtype

TRUNG BÌNH 4.3CVE-2026-33177 · GHSA-wh3h-gvc4-cc2g · Công bố 20/03/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-33177 là lỗ hổng mức TRUNG BÌNH (CVSS 4.3) ảnh hưởng statamic/cms, statamic (statamic).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.23%, cao hơn 14.1% các lỗ hổng khác.
Cách xử lý: cập nhật lên 6.7.0, 5.73.14 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
statamic/cms Packagist	`≥ 6.0.0-alpha.1, < 6.7.0< 5.73.14`	`6.7.05.73.14`
statamic statamic	`≥ 6.0.0, < 6.7.0< 5.73.14`	`6.7.05.73.14`

Mô tả

Impact

Low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action processing endpoint with attacker-controlled field definitions. This bypasses the authorization checks enforced on the standard taxonomy term creation endpoint.

Patches

This has been fixed in 5.73.14 and 6.7.0.

Mô tả của NVD

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action processing endpoint with attacker-controlled field definitions. This bypasses the authorization checks enforced on the standard taxonomy term creation endpoint. This has been fixed in 5.73.14 and 6.7.0.