Statamic is missing authorization check on taxonomy term creation via fieldtype

published 2026-03-18 7 mo ago modified 2026-06-17 4 mo ago also GHSA-wh3h-gvc4-cc2g , EUVD-2026-13827

cvss: 4.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 14%
public exploits: 0; none known

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action processing endpoint with attacker-controlled field definitions. This bypasses the authorization checks enforced on the standard taxonomy term creation endpoint. This has been fixed in 5.73.14 and 6.7.0.

Patch / fix

fixed in 2

packagist statamic/cms 5.73.14, 6.7.0
statamic statamic 5.73.14, 6.7.0

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 7 mo ago (2026-03-23)

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
GitHub	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
packagist	statamic/cms	>=6.0.0-alpha.1, <6.7.0 <5.73.14	6.7.0 5.73.14

Affected products

statamic cms

Classification

Weakness

CWE-862 Missing Authorization

References

github.com /statamic/cms/security/advisories/GHSA-wh3h-gvc4-cc2g
web, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2026-33177
advisory
github.com /statamic/cms
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary