Access Control Flaw in Statamic CMS Affects Content Security
CVE-2026-33884

4.3MEDIUM

Key Information:

Vendor

Statamic

Status
Cms
Vendor
CVE Published:
27 March 2026

What is CVE-2026-33884?

An identified issue in Statamic CMS allows authenticated Control Panel users with live preview access to exploit a live preview token. This token could inadvertently permit access to restricted content not intended for that user. The issue has been resolved in versions 5.73.16 and 6.7.2, reinforcing the significance of timely updates to mitigate potential unauthorized access.

Affected Version(s)

cms < 5.73.16 < 5.73.16

cms >= 6.0.0-alpha.1, < 6.7.2 < 6.0.0-alpha.1, 6.7.2

References

https://github.com/statamic/cms/security/advisories/GHSA-...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.