EUVD-2026-54234
GHSA-qh8c-7588-qfrv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CP account required (PR:L), endpoint is network-reachable over HTTP (AV:N), no special conditions beyond valid session (AC:L), and impact is read-only full content disclosure (C:H/I:N/A:N).
Primary rating from Vendor (https://github.com/statamic/cms).
CVSS VectorVendor: https://github.com/statamic/cms
Lifecycle Timeline
2DescriptionCVE.org
Impact
An authenticated Control Panel user could view content from entries they don't have permission to view, including entry content and custom field values, from any collection and including unpublished entries. No data could be modified.
Patches
This has been fixed in 5.74.1 and 6.24.0.
AnalysisAI
Unauthorized entry disclosure in Statamic CMS exposes restricted content to any authenticated Control Panel user, regardless of their assigned role permissions. Any CP account - even one holding only the 'access cp' permission - can read entry content, custom field values, and unpublished drafts from any collection by querying the navigation pages endpoint. No data can be modified. Vendor-released patches exist for both active branches (5.74.1 and 6.24.0); no public exploit or active exploitation has been identified at time of analysis.
Technical ContextAI
Statamic is a Laravel-based flat-file CMS distributed as the Composer package statamic/cms (pkg:composer/statamic_cms). The vulnerable component is src/Http/Controllers/CP/Navigation/NavigationPagesController.php, which handles the Control Panel's navigation page management endpoints (create, edit, update). These actions accepted user-supplied entry IDs as request parameters and returned full entry data without invoking Laravel's authorization gate ($this->authorize('view', $entry)). CWE-639 (Authorization Bypass Through User-Controlled Key) precisely describes the root cause: a user-controlled identifier (the entry UUID) was used to retrieve a resource without verifying the requesting user's permission to view that resource. The fix in PR #14906 adds $this->authorize calls at the top of the create, edit, and update actions for both the navigation object and the referenced entry, ensuring Statamic's role-based permission system is actually enforced.
RemediationAI
Upgrade Statamic to version 5.74.1 (5.x branch) or 6.24.0 (6.x branch). Release artifacts are available at https://github.com/statamic/cms/releases/tag/v5.74.1 and https://github.com/statamic/cms/releases/tag/v6.24.0; the underlying code fix is in https://github.com/statamic/cms/pull/14906. If an immediate upgrade is not feasible, restrict Control Panel access so that only fully trusted personnel hold CP credentials - this removes the required PR:L prerequisite entirely. Additionally, audit existing CP role assignments to reduce the pool of accounts that could exploit the navigation endpoints. There is no selective workaround that blocks the vulnerable navigation endpoints without disabling navigation management functionality in the CP.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today