CVE-2026-54244

3.5 Faible

Publiée le 17/07/2026 à 23:17 · Modifiée le 23/07/2026 à 17:05 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in src/Http/Controllers/CP/PreviewController.php only checked view authorization, but it accepts and renders caller-supplied field values. A Control Panel user with view but not edit permission could therefore submit content they were not authorized to author and generate a shareable Live Preview URL rendering it. This issue is fixed in versions 5.74.0 and 6.20.3.

Traduire en français

Produits concernés

statamic cms

Scores CVSS

Version	Score	Source	Vecteur
3.1	3.5 Faible	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-863

Références

https://github.com/statamic/cms/commit/87b9998f4d9e40de53346402ccf6eb3c17ba168f
https://github.com/statamic/cms/pull/14791
https://github.com/statamic/cms/releases/tag/v5.74.0
https://github.com/statamic/cms/releases/tag/v6.20.3
https://github.com/statamic/cms/security/advisories/GHSA-7mqq-4v55-88gh

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories