What is the CVSS score of CVE-2026-49288?

CVE-2026-49288 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-49288?

Yes, a patch is available for CVE-2026-49288. Update the affected software to the latest version immediately.

Statamic CMS CVE-2026-49288

EUVD-2026-38059 MEDIUM

Information Exposure (CWE-200)

2026-06-19 GitHub_M

GHSA-2497-6pwj-pwg7

Information Disclosure Cms Statamic

4.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable Control Panel requires low-privilege authenticated access (PR:L); only bounded confidentiality is impacted (C:L), with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 19, 2026 - 21:02 EUVD

Analysis Generated

Jun 19, 2026 - 19:01 vuln.today

DescriptionCVE.org

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Control Panel user could view metadata and content for resources they don't have permission to view, including entries, assets, users, roles, groups, and other configured resources. Depending on the resource, this could expose titles, custom field values, entry content, asset metadata, and the existence of users, roles, and groups. No data could be modified. This has been fixed in 5.73.23 and 6.20.0.

AnalysisAI

Unauthorized resource disclosure in Statamic CMS allows any authenticated Control Panel user to read metadata and content for entries, assets, users, roles, and groups beyond their assigned permissions. All v5 releases prior to 5.73.23 and all v6 releases prior to 6.20.0 are affected. Exploitation is read-only - no data can be modified - and no public exploit has been identified at time of analysis, but the flaw is significant for multi-tenant deployments relying on Statamic's role-based access controls to segregate content.

Technical ContextAI

Statamic is a flat-file, Git-backed CMS built on the Laravel framework. Resource authorization in Statamic's Control Panel is enforced at the policy layer, but this vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) indicates that the resource-fetching logic fails to consistently validate whether the requesting authenticated user holds view permission for a given resource type. This allows lower-privileged Control Panel accounts to reach entries, assets, user records, roles, and groups they should be denied. The CPE cpe:2.3:a:statamic:cms:*:*:*:*:*:*:*:* covers all Statamic CMS versions, with no platform or OS constraint, confirming the flaw is in application logic rather than infrastructure.

RemediationAI

The primary fix is to upgrade Statamic CMS to version 5.73.23 (for v5 installations) or 6.20.0 (for v6 installations), as confirmed by the vendor advisory at https://github.com/statamic/cms/security/advisories/GHSA-2497-6pwj-pwg7. If an immediate upgrade is not feasible, the most effective compensating control is to audit and revoke Control Panel access for any non-essential or low-trust user accounts, since exploitation requires an existing authenticated session - reducing the pool of authenticated users directly reduces exposure. A secondary mitigation is to restrict Control Panel access at the network layer (e.g., limit access to trusted IP ranges or a VPN), which raises the practical bar for an attacker to obtain and use credentials. Neither workaround addresses the underlying authorization defect; patching is the only complete remediation.