Statamic CMS CVE-2026-49288

Exploitation requires an active, authenticated session with any Control Panel role in Statamic CMS - there is no unauthenticated attack path. The attacker must possess valid Control Panel credentials for a low-privilege account (PR:L per the CVSS vector). The vulnerability is most impactful in deployments with multiple users assigned different permission scopes, where Statamic's access control policies are relied upon to segment content visibility. The flaw is read-only: no resource modification, creation, or deletion is possible. Deployments where all Control Panel users share the same role, or where only a single administrator has Control Panel access, have no meaningful exposure.

The NVD-assigned CVSS 3.1 base score of 4.3 (Medium) is well-calibrated: AV:N/AC:L confirms easy network reachability, PR:L establishes that a low-privilege authenticated session is the sole prerequisite, and C:L/I:N/A:N accurately reflects a read-only, bounded confidentiality leak. No EPSS score was provided in the source data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, and no POC code has been reported, making this a low-urgency finding for most organizations. Real-world risk is highest in multi-author or multi-tenant Statamic deployments where role segmentation is a deliberate security boundary - for example, where freelance editors should be restricted from viewing another client's entries or where user enumeration is a meaningful attack surface. Single-administrator deployments have negligible practical exposure.

A content editor with a legitimately low-privileged Control Panel account crafts requests to Statamic's internal API or Control Panel resource endpoints, targeting collections, asset containers, or user directories outside their assigned permissions. They successfully read draft entry content from a restricted collection, enumerate internal user accounts by ID, or retrieve custom field values containing confidential business data. No public POC has been identified, but the attack requires only standard HTTP interaction with the Control Panel and no privilege escalation beyond the initial authenticated session.