CVE-2026-64662

MEDIUM 6.5

Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from entries they did not have permission to view, including entry content and custom field values, from any collection and including unpublished entries, through the navigation endpoint, though no data could be modified. This issue is fixed in versions 5.74.1 and 6.24.0.

CWE	CWE-639 CWE-862
Vendor	statamic
Product	cms
Published	Aug 6, 2026

Stay Ahead of the Next One

Get instant alerts for statamic cms

Be the first to know when new medium vulnerabilities affecting statamic cms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

statamic / cms

< 5.74.1 >= 6.0.0, < 6.24.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/statamic/cms/security/advisories/GHSA-qh8c-7588-qfrv github.com: https://github.com/statamic/cms/pull/14906 github.com: https://github.com/statamic/cms/commit/6557f1d8a0d61c0e7ad9c9a8f42cb3288607495d github.com: https://github.com/statamic/cms/releases/tag/v5.74.1 github.com: https://github.com/statamic/cms/releases/tag/v6.24.0