What is the CVSS score of CVE-2026-54244?

CVE-2026-54244 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-54244?

Yes, a patch is available for CVE-2026-54244. Update the affected software to the latest version immediately.

Statamic CMS CVE-2026-54244

EUVD-2026-45319 LOW

Incorrect Authorization (CWE-863)

2026-06-26 https://github.com/statamic/cms

GHSA-7mqq-4v55-88gh

Authentication Bypass

3.5

CVSS 3.1 · Vendor: https://github.com/statamic/cms

Severity by source

Vendor (https://github.com/statamic/cms) PRIMARY

3.5 LOW

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

3.5 LOW

PR:L confirmed since Control Panel account is required; UI:R because third-party must view the shared preview URL for meaningful impact; I:L only since no content is persisted or published.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/statamic/cms).

CVSS VectorVendor: https://github.com/statamic/cms

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 26, 2026 - 23:33 vuln.today

Analysis Generated

Jun 26, 2026 - 23:33 vuln.today

DescriptionCVE.org

Impact

The Live Preview endpoint for existing entries and terms only checked view authorization, but it accepts and renders caller-supplied field values. A Control Panel user with view but not edit permission could therefore submit content they were not authorized to author and generate a shareable Live Preview URL rendering it.

Patches

This has been fixed in 5.74.0 and 6.20.3.

AnalysisAI

Incorrect authorization in Statamic CMS's Live Preview endpoint allows authenticated Control Panel users with view-only permissions to submit and render arbitrary field values they are not authorized to edit. By exploiting this flaw, a restricted user can generate a shareable Live Preview URL that displays unauthorized content as if authored through legitimate editorial workflow. No public exploit code or active exploitation has been identified; this is a low-severity integrity issue confirmed patched by the vendor in versions 5.74.0 and 6.20.3.

Technical ContextAI

Statamic CMS (composer/statamic/cms) is a Laravel-based flat-file content management system exposing a Control Panel with role-based access controls. The Live Preview feature renders draft field values before publication via a dedicated endpoint. The root cause is CWE-863 (Incorrect Authorization): the endpoint performs an authorization check for view permissions but omits a parallel check for edit or create permissions before accepting and rendering caller-supplied field values. This violates the principle that write-adjacent actions (supplying content to be rendered and shared) require at minimum write authorization. The vulnerability affects the 5.x branch below 5.74.0 and the 6.x branch from 6.0.0 up to but not including 6.20.3, as identified via CPE pkg:composer/statamic_cms.

RemediationAI

Upgrade Statamic CMS to version 5.74.0 (for 5.x deployments) or 6.20.3 (for 6.x deployments), as confirmed by the vendor in the GitHub Security Advisory GHSA-7mqq-4v55-88gh at https://github.com/statamic/cms/security/advisories/GHSA-7mqq-4v55-88gh. For sites that cannot immediately upgrade, a compensating control is to audit and tighten Control Panel user roles so that only users who legitimately need access to the Live Preview feature retain view permissions on entries and terms - this reduces the pool of potential abusers without disabling the feature. Alternatively, restricting Live Preview endpoint access at the web server or WAF layer to known editor IP ranges can limit exposure, though this may disrupt legitimate preview workflows for remote contributors.