CVE-2026-33887 json
Statamic allows unauthorized content access through missing authorization in its revision controllers
published 2026-03-26 7 mo ago modified 2026-10-26 13 d ago also EUVD-2026-16832 , GHSA-4hp7-3wxg-cv9q
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 3%
- public exploits
- 0
- none known
Summary
Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, authenticated Control Panel users could view entry revisions for any collection with revisions enabled, regardless of whether they had the required collection permissions. This bypasses the authorization checks that the main entry controllers enforce, exposing entry field values and blueprint data. Users could also create entry revisions without edit permission, though this only snapshots the existing content state and does not affect published content. This has been fixed in 5.73.16 and 6.7.2.
Patch / fix
- packagist statamic/cms 5.73.16, 6.7.2
- statamic statamic 5.73.16, 6.7.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 7 mo ago
Exploit prediction
0.15% chance of exploitation in the next 30 days, higher than 3% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | statamic/cms | <5.73.16 >=6.0.0-alpha.1, <6.7.2 |
5.73.16 6.7.2 |
Affected products
- statamic cms
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/statamic/cms/security/advisories/GHSA-4hp7-3wxg-cv9q
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-33887
advisory
-
github.com
/statamic/cms
package
Sources
- CVE List CVE-2026-33887
- GitHub Advisory GHSA-4hp7-3wxg-cv9q
- NVD CVE-2026-33887
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.