CVE-2026-64662

Summary

Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries

Severity

medium

CVSS

6.5

EPSS

0.4% (p36)

CWE

CWE-639, CWE-862

Also known as

GHSA-qh8c-7588-qfrv

Published

2026-08-06

Updated

2026-08-06

Advisory details

Impact

An authenticated Control Panel user could view content from entries they don't have permission to view, including entry content and custom field values, from any collection and including unpublished entries. No data could be modified.

Patches

This has been fixed in 5.74.1 and 6.24.0.

References

• https://github.com/advisories/GHSA-qh8c-7588-qfrv
• https://github.com/statamic/cms/security/advisories/GHSA-qh8c-7588-qfrv
• https://github.com/statamic/cms/pull/14906
• https://github.com/statamic/cms/commit/6557f1d8a0d61c0e7ad9c9a8f42cb3288607495d
• https://github.com/statamic/cms/releases/tag/v5.74.1
• https://github.com/statamic/cms/releases/tag/v6.24.0

Related advisories

• CVE-2026-105859 — critical · npm/payload
• CVE-2026-111767 — high · npm/@modelcontextprotocol/sdk
• CVE-2026-91985 — high · Go/code.vikunja.io/api
• CVE-2026-76089 — high · Packagist/verbb/formie
• CVE-2026-76087 — high · Packagist/verbb/formie
• CVE-2026-77426 — high · npm/unleash-server
• CVE-2026-61596 — high · PyPI/djust
• CVE-2026-61592 — high · PyPI/djust

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity