CVE-2026-32612

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32612", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-12T14:54:24.270Z", "datePublished": "2026-03-12T21:47:21.697Z", "dateUpdated": "2026-03-13T16:38:42.464Z"}, "containers": {"cna": {"title": "Statamic: privilege escalation via stored cross-site scripting", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/statamic/cms/security/advisories/GHSA-hcch-w73c-jp4m", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/statamic/cms/security/advisories/GHSA-hcch-w73c-jp4m"}, {"name": "https://github.com/Shirshaw64p/security-advisories/tree/main/CVE-2026-32612", "tags": ["x_refsource_MISC"], "url": "https://github.com/Shirshaw64p/security-advisories/tree/main/CVE-2026-32612"}], "affected": [{"vendor": "statamic", "product": "cms", "versions": [{"version": ">= 6.0.0, < 6.6.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-13T16:38:42.464Z"}, "descriptions": [{"lang": "en", "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 6.6.2, stored XSS in the control panel color mode preference allows authenticated users with control panel access to inject malicious JavaScript that executes when a higher-privileged user impersonates their account. This has been fixed in 6.6.2."}], "source": {"advisory": "GHSA-hcch-w73c-jp4m", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-13T14:48:16.603802Z", "id": "CVE-2026-32612", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T14:48:23.501Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32612", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-13T14:48:16.603802Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T14:48:19.706Z"}}], "cna": {"title": "Statamic: privilege escalation via stored cross-site scripting", "source": {"advisory": "GHSA-hcch-w73c-jp4m", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "statamic", "product": "cms", "versions": [{"status": "affected", "version": ">= 6.0.0, < 6.6.2"}]}], "references": [{"url": "https://github.com/statamic/cms/security/advisories/GHSA-hcch-w73c-jp4m", "name": "https://github.com/statamic/cms/security/advisories/GHSA-hcch-w73c-jp4m", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Shirshaw64p/security-advisories/tree/main/CVE-2026-32612", "name": "https://github.com/Shirshaw64p/security-advisories/tree/main/CVE-2026-32612", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 6.6.2, stored XSS in the control panel color mode preference allows authenticated users with control panel access to inject malicious JavaScript that executes when a higher-privileged user impersonates their account. This has been fixed in 6.6.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-13T16:38:42.464Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32612", "state": "PUBLISHED", "dateUpdated": "2026-03-13T16:38:42.464Z", "dateReserved": "2026-03-12T14:54:24.270Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-12T21:47:21.697Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "cms", "vendor": "statamic", "versions": [{"status": "affected", "version": ">= 6.0.0, < 6.6.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:*", "matchCriteriaId": "7774FDC9-D73F-41FB-8244-632B78A562CE", "versionEndExcluding": "6.6.2", "versionStartIncluding": "6.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 6.6.2, stored XSS in the control panel color mode preference allows authenticated users with control panel access to inject malicious JavaScript that executes when a higher-privileged user impersonates their account. This has been fixed in 6.6.2."}, {"lang": "es", "value": "Statamic es un sistema de gesti\u00f3n de contenido (CMS) impulsado por Laravel y Git. Antes de 6.6.2, un XSS almacenado en la preferencia de modo de color del panel de control permite a usuarios autenticados con acceso al panel de control inyectar JavaScript malicioso que se ejecuta cuando un usuario con mayores privilegios suplanta su cuenta. Esto ha sido corregido en 6.6.2."}], "id": "CVE-2026-32612", "lastModified": "2026-06-17T10:36:05.967", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32612", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-13T14:48:16.603802Z", "version": "2.0.3"}}]}, "published": "2026-03-13T19:55:09.813", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "url": "https://github.com/Shirshaw64p/security-advisories/tree/main/CVE-2026-32612"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/statamic/cms/security/advisories/GHSA-hcch-w73c-jp4m"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0.0,6.6.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "cms", "source": "cna", "vendor": "statamic"}, "product": "cms", "vendor": "statamic"}], "analysis": {"en": {"generated_at": "2026-03-19T15:54:11.278468+00:00", "value": {"mitigation_remediation": ["Upgrade Statamic CMS to version 6.6.2 or newer.", "If an upgrade is not immediately feasible, review and restrict account impersonation permissions to reduce risk.", "Consult Statamic support or community resources for additional guidance."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation via stored XSS"}, "threat_synthesis": {"affected_systems": "All Statamic CMS installations running any version prior to 6.6.2 are affected. The vulnerability is specific to the control panel color mode setting feature and is resolved in version 6.6.2 and later.", "description_and_impact": "Statamic CMS, built on Laravel, is vulnerable to a stored cross\u2011site scripting (XSS) flaw in the control panel color mode preference. Authenticated users with control panel access can store malicious JavaScript that is executed when a higher\u2011privileged user impersonates the compromised account. This allows the attacker to run arbitrary code in the context of the impersonator, effectively elevating privileges. The weakness corresponds to CWE\u201179 (Improper Neutralization of Input During Web Page Generation).", "risk_and_exploitability": "The CVSS v3.1 score is 5.4, indicating moderate severity, while the EPSS score is below 1%, suggesting low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated user with control panel access to inject the payload, and the attack vector relies on the impersonation capability of higher\u2011privileged users. Given these conditions, the risk is moderate but exploit probability remains low."}}}}, "created": "2026-03-13T09:49:27.292325+00:00", "updated": "2026-03-23T10:00:01.997916+00:00", "vendors": ["statamic", "statamic$PRODUCT$cms"]}