What is the CVSS score of CVE-2026-27939?

CVE-2026-27939 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Laravel are affected by CVE-2026-27939?

Statmatic CMS versions 6.0.0 through 6.3.x contain a privilege escalation vulnerability allowing authenticated control panel users to bypass security verification and gain unauthorized elevated…. A patch is available.

How to fix or mitigate CVE-2026-27939?

Within 24 hours: Identify all systems running Statmatic CMS versions 6.0.0-6.3.x and restrict control panel access to essential personnel only. Within 7 days: Apply vendor patch to upgrade to version 6.4.0 or later across all affected instances. Within 30 days: Conduct access logs review for the past 90 days to detect unauthorized privilege escalations and audit all administrative actions performed by control panel users.

Laravel CVE-2026-27939

HIGH

Improper Authentication (CWE-287)

2026-02-27 security-advisories@github.com

GHSA-rw9x-pxqx-q789

Laravel Privilege Escalation Statamic

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Mar 10, 2026 - 15:20 nvd

Patch available

CVE Published

Feb 27, 2026 - 22:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

Statmatic is a Laravel and Git powered content management system (CMS). Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel users may under certain conditions obtain elevated privileges without completing the intended verification step. This can allow access to sensitive operations and, depending on the user’s existing permissions, may lead to privilege escalation. This has been fixed in 6.4.0.

AnalysisAI

Authenticated Statamic CMS users (versions 6.0.0-6.3.x) can bypass privilege escalation verification checks to gain unauthorized elevated access, potentially enabling unauthorized sensitive operations depending on existing permissions. The vulnerability affects both Statamic and its Laravel framework integration, with a patch available in version 6.4.0.

Technical ContextAI

Classified as CWE-287 (Improper Authentication). Affects Statamic. Statmatic is a Laravel and Git powered content management system (CMS). Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel users may under certain conditions obtain elevated privileges without completing the intended verification step. This can allow access to sensitive operations and, depending on the user’s existing permissions, may lead to privilege escalation. This has been fixed in 6.4.0.