CVE-2026-54244— Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editors
Possible ATT&CK Techniques 1AI
T1133 · External Remote ServicesGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-54244
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editors
Source: NVD (National Vulnerability Database)
Vulnerability Description
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in src/Http/Controllers/CP/PreviewController.php only checked view authorization, but it accepts and renders caller-supplied field values. A Control Panel user with view but not edit permission could therefore submit content they were not authorized to author and generate a shareable Live Preview URL rendering it. This issue is fixed in versions 5.74.0 and 6.20.3.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制不正确
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-54244
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54244
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-54244 (2)
- 🔗 Release v6.20.3 · statamic/cms · GitHubx_refsource_MISC
Vendor Advisories for CVE-2026-54244 (1)
Vendor Pages for CVE-2026-54244 (1)
- 🔗 Release v5.74.0 · statamic/cms · GitHubx_refsource_MISC
Same Patch Batch · statamic · 2026-07-17 · 3 CVEs total
| CVE-2026-54243 | 6.1 MEDIUM | Statamic: CSV formula injection in form submission exports |
| CVE-2026-54242 | 4.9 MEDIUM | Statamic: Server-Side Request Forgery via Glide (DNS rebinding) |
IV. Related Vulnerabilities
Same product: cms
- CVE-2026-16219
Croogo CMS Admin File Manager FileManager.php isEditable pat - CVE-2026-16205
Pluck CMS Albums albums.admin.php htmlspecialchars_decode cr - CVE-2026-54243
Statamic: CSV formula injection in form submission exports - CVE-2026-54242
Statamic: Server-Side Request Forgery via Glide (DNS rebindi - CVE-2026-12257
Remote code execution in Mura Software’s CMS
Same vendor: statamic
- CVE-2026-54243
Statamic: CSV formula injection in form submission exports - CVE-2026-54242
Statamic: Server-Side Request Forgery via Glide (DNS rebindi - CVE-2026-49288
Statamic CMS missing authorization on Control Panel fieldtyp - CVE-2026-49287
Statamic CMS vulnerable to unsafe method invocation via coll - CVE-2026-45660
Statamic: Server-Side Request Forgery via Glide
Same weakness: CWE-863
- CVE-2026-47128
nono: Sandbox escape on Linux via D-Bus: `systemd-run --user - CVE-2026-44507
Rsync: hostname/ACL bypass on DNS-lookup failure - CVE-2026-64650
AI SDK Codex Harness Tool Relay Authorization Bypass - CVE-2026-64651
AI SDK OpenCode Harness Tool Relay Authorization Bypass - CVE-2026-63755
SurrealDB before 3.1.0 Permission Bypass via WHERE Clause
V. Comments for CVE-2026-54244
No comments yet