Privilege Escalation in Statamic CMS by Statamic
CVE-2026-27939

8.8HIGH

Key Information:

Vendor

Statamic

Status
Cms
Vendor
CVE Published:
27 February 2026

What is CVE-2026-27939?

Statamic CMS, powered by Laravel and Git, has a vulnerability where authenticated control panel users can gain elevated privileges under certain conditions without completing the necessary verification steps. This flaw can lead to unauthorized access to sensitive operations, potentially compromising user permissions. The issue has been addressed in version 6.4.0.

Affected Version(s)

cms >= 6.0.0, < 6.4.0

References

https://github.com/statamic/cms/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/statamic/cms/commit/8639ef96217eaa682b...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.