Unauthorized Taxonomy Term Creation in Statamic CMS by Low-Privileged Users

CVE-2026-33177

What is CVE-2026-33177?

Statamic CMS, a content management system built on Laravel and Git, was found to have a vulnerability that allowed low-privileged Control Panel users to create taxonomy terms. This was accomplished by submitting requests to the field action processing endpoint with field definitions controlled by the attacker. This flaw bypassed the authorization checks that are normally enforced when creating taxonomy terms through the designated endpoint. The issue has been addressed in Statamic CMS versions 5.73.14 and 6.7.0, ensuring better security for content management operations.

References