Executive brief
Statamic is a content management system used to build and manage websites. A security flaw in the Live Preview feature allowed users who only had permission to view content to bypass restrictions and submit unauthorized changes for preview. While this does not permanently change the live website, it allows unauthorized users to generate and share preview links containing content they are not permitted to author.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in Statamic CMS within the Live Preview functionality. The PreviewController.php component for existing entries and terms validated 'view' permissions but failed to enforce 'edit' permissions when processing caller-supplied field values. An authenticated Control Panel user with read-only access could submit arbitrary content to the preview endpoint and generate a shareable URL rendering that content. The attack requires network access and low privileges, with some user interaction required to view the generated preview. The issue is resolved in versions 5.74.0 and 6.20.3 by ensuring the endpoint requires proper edit authorization.
Affected products
- Statamic cms < 5.74.0, >= 6.0.0 < 6.20.3
Timeline
- 2026-06-08: patched: Fixes merged and released in v5.74.0 and v6.20.3
- 2026-06-09: advisory: GitHub Security Advisory published
- 2026-07-17: disclosed: CVE published to NVD