Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from entries they did not have permission to view, including entry content and custom field values, from any collection and including unpublished entries, through the navigation endpoint, though no data could be modified. This issue is fixed in versions 5.74.1 and 6.24.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-06T22:18:13.673Z",
  "pubdate": "2026-08-06T22:18:13.673Z",
  "executiveSummary": "Statamic prior to versions 5.74.1 and 6.24.0 suffers from an authorization bypass vulnerability within the navigation endpoint of the Control Panel.\nThe vulnerability allows an authenticated user with valid Control Panel access to retrieve sensitive content from entries, custom field values, arbitrary collections, and unpublished items despite lacking the explicit permissions required to view them.\nThe primary impact is unauthorized information disclosure affecting confidentiality, though data modification capabilities are not present.\nThe risk implication centers on unauthorized exposure of proprietary or sensitive content stored within the Content Management System.\nAttacker capabilities are constrained to authenticated Control Panel users who leverage legitimate application endpoints to bypass permission boundaries.\nExploitation requires active authentication and access to the Control Panel interface to interact with the vulnerable navigation endpoint.",
  "technicalDetails": "The root cause of the vulnerability lies in insufficient access control enforcement within the navigation endpoint of the Statamic Control Panel.\nWhen an authenticated user queries the navigation endpoint, the application fails to adequately validate whether the requesting user possesses the necessary collection-level or entry-level permissions before returning data payloads.\nThe vulnerable component involves the backend routing and controller logic handling navigation requests within the Content Management System.\nAffected software versions include all Statamic installations prior to 5.74.1 in the 5.x branch and prior to 6.24.0 in the 6.x branch.\nAuthentication requirements dictate that the attacker must possess a valid user account with access to the Control Panel, meaning unauthenticated attackers cannot exploit this flaw directly over the network without prior credential compromise.\nPrivilege requirements are low in terms of scoping, as standard authenticated users without elevated permissions can trigger the flaw.\nNetwork exposure is inherent to web applications running Statamic, accessible via standard HTTP/HTTPS protocols exposed by the Laravel framework.\nThe attack flow proceeds as follows: 1. The authenticated low-privilege user navigates to or sends an HTTP request targeting the navigation endpoint within the Control Panel. 2. The backend controller processes the request without enforcing strict authorization checks against the user's specific collection permissions. 3. The server serializes and returns comprehensive entry data, custom field values, and metadata for collections and unpublished content to the client interface. 4. The user receives and reviews the unauthorized data payloads.\nPost-exploitation impact is strictly limited to read-only data exposure, as the lack of validation does not extend to write, update, or delete operations, ensuring data integrity remains intact while confidentiality is breached."
}