Unauthorized Asset Access Vulnerability in Statamic CMS
CVE-2026-25633
4.3MEDIUM
What is CVE-2026-25633?
Statamic CMS, a Laravel and Git-powered content management system, has a vulnerability that allows unauthorized users to access and download assets, along with their metadata. This issue arises in versions prior to 5.73.6 and 6.2.5, where users lacking proper permissions could exploit the system's access control mechanisms. It is important to note that the vulnerability does not affect logged-out users or those without permission to access the control panel. Users are encouraged to update to the latest versions to mitigate this risk.
Affected Version(s)
cms < 5.73.6 < 5.73.6
cms >= 6.0.0-alpha.1, < 6.2.5 < 6.0.0-alpha.1, 6.2.5