CVE-2026-64662: Statamic CMS missing authorization in navigation endpoint

Executive brief

Statamic, a content management system, contains a security flaw where users with access to the Control Panel can view content they are not authorized to see. This includes private entry data, custom field values, and unpublished content from any collection. While attackers can read this sensitive information, they cannot modify or delete any data.

Technical details

A missing authorization vulnerability (CWE-862) and authorization bypass through user-controlled keys (CWE-639) exists in the Statamic CMS navigation endpoint. An authenticated attacker with Control Panel access can exploit this to view restricted entries, custom field values, and unpublished content across all collections, regardless of their assigned permissions. The vulnerability is reachable via the network with low privileges and requires no user interaction. The issue has been resolved in versions 5.74.1 and 6.24.0.

Affected products

• Statamic Statamic CMS < 5.74.1, >= 6.0.0, < 6.24.0

Timeline

• 2026-07-02: disclosed: Initial report to vendor
• 2026-08-06: advisory: GitHub Advisory published
• 2026-08-06: patched

References

• https://api.github.com/users/Pig-Tail
• https://github.com/Pig-Tail
• https://api.github.com/users/Pig-Tail/gists%7B/gist_id%7D
• https://api.github.com/users/Pig-Tail/repos
• https://avatars.githubusercontent.com/u/15832659?v=4
• https://api.github.com/users/Pig-Tail/events%7B/privacy%7D