What is the CVSS score of CVE-2026-41175?

CVE-2026-41175 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Statamic CMS are affected by CVE-2026-41175?

Statamic CMS versions before 5.73.20 and 6.13.0 contain a critical authorization bypass vulnerability allowing authenticated low-privilege users or unauthenticated attackers (in non-default API…. A patch is available.

How to fix or mitigate CVE-2026-41175?

Within 24 hours: Identify all Statamic CMS instances and their versions (affected: <5.73.20 or <6.13.0); audit Control Panel access logs for suspicious deletion activity and review REST/GraphQL API configurations for authentication requirements. Within 7 days: Apply vendor patch to upgrade Statamic to version 5.73.20 or 6.13.0 or later on all affected systems; disable or secure REST/GraphQL APIs if not required. Within 30 days: Review and implement principle of least privilege for all CMS user accounts; conduct forensic analysis for any evidence of unauthorized deletions and validate backups.

Statamic CMS CVE-2026-41175

EUVD-2026-25108 HIGH

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') (CWE-470)

2026-04-22 GitHub_M

GHSA-4jjr-vmv7-wh4w

Information Disclosure Cms

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 27, 2026 - 19:26 nvd

Patch available

Re-analysis Queued

Apr 24, 2026 - 14:52 vuln.today

cvss_changed

Analysis Generated

Apr 23, 2026 - 06:56 vuln.today

Patch available

Apr 22, 2026 - 23:02 EUVD

EUVD ID Assigned

Apr 22, 2026 - 21:46 euvd

EUVD-2026-25108

Analysis Generated

Apr 22, 2026 - 21:46 vuln.today

CVE Published

Apr 22, 2026 - 21:25 nvd

HIGH 8.1

DescriptionGitHub Advisory

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.20 and 6.13.0, manipulating query parameters on Control Panel and REST API endpoints, or arguments in GraphQL queries, could result in the loss of content, assets, and user accounts. The Control Panel requires authentication with minimal permissions in order to exploit. e.g. "view entries" permission to delete entries, or "view users" permission to delete users, etc. The REST and GraphQL API exploits do not require any permissions, however neither are enabled by default. In order to be exploited, they would need to be explicitly enabled with no authentication configured, and the specific resources enabled too. Sites that enable the REST or GraphQL API without authentication should treat patching as critical priority. This has been fixed in 5.73.20 and 6.13.0.

AnalysisAI

Mass deletion of content, assets, and user accounts in Statamic CMS versions prior to 5.73.20 and 6.13.0 occurs via query parameter manipulation on Control Panel endpoints (requiring minimal authentication like 'view entries' permission) or unauthenticated exploitation through REST/GraphQL APIs if explicitly enabled without authentication. Authenticated attackers with low-privilege viewer roles can escalate to delete resources they should only read. Unauthenticated attackers can exploit misconfigured API endpoints (non-default configuration) to achieve the same destructive impact. CVSS 8.1 (High) reflects network-accessible attack with low complexity, though exploitation conditions vary significantly by deployment configuration. No active exploitation confirmed (not in CISA KEV), EPSS data not provided.

Technical ContextAI

Statamic is a Laravel-based flat-file CMS (CPE: cpe:2.3:a:statamic:cms) that provides Control Panel UI, optional REST API, and optional GraphQL API for content management. The vulnerability is classified as CWE-470 (Use of Externally-Controlled Input to Select Classes or Code), indicating unsafe handling of user-supplied parameters in query strings or GraphQL arguments. The flaw allows HTTP parameter pollution or argument injection to bypass authorization checks that should enforce separation between read ('view') and write ('delete') operations. The Laravel framework's request handling and Statamic's permission middleware appear to improperly validate parameter-based resource identifiers or action selectors, allowing low-privilege authenticated users to invoke privileged deletion operations. The REST and GraphQL APIs, when enabled without authentication guards, expose the same vulnerable parameter handling to completely unauthenticated attackers.

RemediationAI

Upgrade immediately to Statamic CMS version 5.73.20 (for 5.x deployments) or 6.13.0 (for 6.x deployments) per vendor advisory at https://github.com/statamic/cms/security/advisories/GHSA-4jjr-vmv7-wh4w. For sites that have enabled REST or GraphQL APIs, treat as emergency patch due to potential unauthenticated mass deletion exposure. If immediate patching is not possible, implement these compensating controls: (1) Disable REST API and GraphQL API endpoints entirely in config/statamic/api.php and config/statamic/graphql.php until patching completes-this eliminates unauthenticated attack vector with no functional loss if APIs are not actively used, though breaks any third-party integrations relying on these interfaces. (2) If APIs must remain active, enforce authentication by configuring guards in api.php and graphql.php middleware settings-requires application restart and testing of API client authentication flows. (3) Review Control Panel user permissions and apply least-privilege principle, downgrading viewer-role accounts that do not require delete capabilities-reduces authenticated attack surface but does not eliminate vulnerability. (4) Deploy web application firewall rules to detect and block suspicious patterns in query parameters targeting known Statamic endpoints (e.g., multiple 'id[]' parameters, unusual HTTP methods on read-only resources)-may generate false positives and requires tuning.