Is statamic/cms affected by CVE-2026-54244?

Packagist statamic/cms is affected in = 6.0.0 < 6.20.3.

Is CVE-2026-54244 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.3%.

low

CVE-2026-54244

Q: Is CVE-2026-54244 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.3%.

Packagist · statamic/cms

Summary

Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors

Severity: low
CVSS: 3.5
EPSS: 0.3% (p23)
CWE: CWE-863
Also known as: GHSA-7mqq-4v55-88gh
Published: 2026-06-26
Updated: 2026-06-26

Advisory details

Impact

The Live Preview endpoint for existing entries and terms only checked view authorization, but it accepts and renders caller-supplied field values. A Control Panel user with view but not edit permission could therefore submit content they were not authorized to author and generate a shareable Live Preview URL rendering it.

Patches

This has been fixed in 5.74.0 and 6.20.3.

References

Related advisories

CVE-2026-49288 — medium · Packagist/statamic/cms
CVE-2026-64665 — high · Packagist/statamic/cms
CVE-2026-49287 — high · Packagist/statamic/cms
CVE-2026-41175 — high · Packagist/statamic/cms
CVE-2026-71435 — medium · Packagist/statamic/cms
CVE-2026-71434 — medium · Packagist/statamic/cms
CVE-2026-64662 — medium · Packagist/statamic/cms
CVE-2026-64663 — medium · Packagist/statamic/cms

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.