CVE-2026-41175

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41175", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-17T16:34:45.526Z", "datePublished": "2026-04-22T21:25:49.585Z", "dateUpdated": "2026-04-23T13:56:09.912Z"}, "containers": {"cna": {"title": "Statamic: Unsafe method invocation via query value resolution allows data destruction", "problemTypes": [{"descriptions": [{"cweId": "CWE-470", "lang": "en", "description": "CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/statamic/cms/security/advisories/GHSA-4jjr-vmv7-wh4w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/statamic/cms/security/advisories/GHSA-4jjr-vmv7-wh4w"}], "affected": [{"vendor": "statamic", "product": "cms", "versions": [{"version": "< 5.73.20", "status": "affected"}, {"version": ">= 6.0.0-alpha.1, < 6.13.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-22T21:25:49.585Z"}, "descriptions": [{"lang": "en", "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.20 and 6.13.0, manipulating query parameters on Control Panel and REST API endpoints, or arguments in GraphQL queries, could result in the loss of content, assets, and user accounts. The Control Panel requires authentication with minimal permissions in order to exploit. e.g. \"view entries\" permission to delete entries, or \"view users\" permission to delete users, etc. The REST and GraphQL API exploits do not require any permissions, however neither are enabled by default. In order to be exploited, they would need to be explicitly enabled with no authentication configured, and the specific resources enabled too. Sites that enable the REST or GraphQL API without authentication should treat patching as critical priority. This has been fixed in 5.73.20 and 6.13.0."}], "source": {"advisory": "GHSA-4jjr-vmv7-wh4w", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-23T13:56:00.759524Z", "id": "CVE-2026-41175", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-23T13:56:09.912Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Statamic: Unsafe method invocation via query value resolution allows data destruction", "source": {"advisory": "GHSA-4jjr-vmv7-wh4w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "statamic", "product": "cms", "versions": [{"status": "affected", "version": "< 5.73.20"}, {"status": "affected", "version": ">= 6.0.0-alpha.1, < 6.13.0"}]}], "references": [{"url": "https://github.com/statamic/cms/security/advisories/GHSA-4jjr-vmv7-wh4w", "name": "https://github.com/statamic/cms/security/advisories/GHSA-4jjr-vmv7-wh4w", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.20 and 6.13.0, manipulating query parameters on Control Panel and REST API endpoints, or arguments in GraphQL queries, could result in the loss of content, assets, and user accounts. The Control Panel requires authentication with minimal permissions in order to exploit. e.g. \"view entries\" permission to delete entries, or \"view users\" permission to delete users, etc. The REST and GraphQL API exploits do not require any permissions, however neither are enabled by default. In order to be exploited, they would need to be explicitly enabled with no authentication configured, and the specific resources enabled too. Sites that enable the REST or GraphQL API without authentication should treat patching as critical priority. This has been fixed in 5.73.20 and 6.13.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-470", "description": "CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-22T21:25:49.585Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41175", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-23T13:56:00.759524Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-04-23T13:56:06.140Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-41175", "state": "PUBLISHED", "dateUpdated": "2026-04-22T21:25:49.585Z", "dateReserved": "2026-04-17T16:34:45.526Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-22T21:25:49.585Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "cms", "vendor": "statamic", "versions": [{"status": "affected", "version": "< 5.73.20"}, {"status": "affected", "version": ">= 6.0.0-alpha.1, < 6.13.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:*", "matchCriteriaId": "A17AD3F4-2303-47FC-BA7C-76C874B19A44", "versionEndExcluding": "5.73.20", "vulnerable": true}, {"criteria": "cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:*", "matchCriteriaId": "43E0EBB0-7923-4A58-A331-E298D7680E66", "versionEndExcluding": "6.13.0", "versionStartIncluding": "6.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.20 and 6.13.0, manipulating query parameters on Control Panel and REST API endpoints, or arguments in GraphQL queries, could result in the loss of content, assets, and user accounts. The Control Panel requires authentication with minimal permissions in order to exploit. e.g. \"view entries\" permission to delete entries, or \"view users\" permission to delete users, etc. The REST and GraphQL API exploits do not require any permissions, however neither are enabled by default. In order to be exploited, they would need to be explicitly enabled with no authentication configured, and the specific resources enabled too. Sites that enable the REST or GraphQL API without authentication should treat patching as critical priority. This has been fixed in 5.73.20 and 6.13.0."}, {"lang": "es", "value": "Statamic es un sistema de gesti\u00f3n de contenido (CMS) impulsado por Laravel y Git. Antes de las versiones 5.73.20 y 6.13.0, la manipulaci\u00f3n de par\u00e1metros de consulta en los puntos finales del Panel de Control y la API REST, o argumentos en consultas GraphQL, podr\u00eda resultar en la p\u00e9rdida de contenido, activos y cuentas de usuario. El Panel de Control requiere autenticaci\u00f3n con permisos m\u00ednimos para poder explotar. p. ej. permiso de \u2019ver entradas\u2019 para eliminar entradas, o permiso de \u2019ver usuarios\u2019 para eliminar usuarios, etc. Los exploits de la API REST y GraphQL no requieren ning\u00fan permiso, sin embargo, ninguno est\u00e1 habilitado por defecto. Para poder ser explotados, necesitar\u00edan ser habilitados expl\u00edcitamente sin autenticaci\u00f3n configurada, y los recursos espec\u00edficos tambi\u00e9n habilitados. Los sitios que habilitan la API REST o GraphQL sin autenticaci\u00f3n deber\u00edan tratar la aplicaci\u00f3n de parches como una prioridad cr\u00edtica. Esto ha sido corregido en 5.73.20 y 6.13.0."}], "id": "CVE-2026-41175", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41175", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-23T13:56:00.759524Z", "version": "2.0.3"}}]}, "published": "2026-04-22T22:16:31.820", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/statamic/cms/security/advisories/GHSA-4jjr-vmv7-wh4w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-470"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.73.20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0.0-alpha.1,6.13.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "cms", "source": "cna", "vendor": "statamic"}, "product": "cms", "vendor": "statamic"}], "analysis": {"en": {"generated_at": "2026-04-27T08:21:38.715323+00:00", "value": {"mitigation_remediation": ["Upgrade Statamic CMS to version 5.73.20 or higher (for 5.x) or 6.13.0 or higher (for 6.x).", "If the REST or GraphQL API endpoints are enabled, disable them or enforce proper authentication and resource restrictions.", "Review Control Panel user permissions and remove delete privileges for accounts that do not need them, ensuring the principle of least privilege is enforced."], "summary": {"action": "Immediate Patch", "impact": "Data Destruction"}, "threat_synthesis": {"affected_systems": "Statamic CMS versions prior to 5.73.20 for the 5.x line and prior to 6.13.0 for the 6.x line are affected. The vulnerability applies to sites running these releases where Control Panel, REST API, or GraphQL API endpoints are exposed.", "description_and_impact": "Statamic is vulnerable because manipulating query parameters on Control Panel and REST API endpoints and arguments in GraphQL queries can trigger unsafe method invocation, resulting in deletion of content, assets, or user accounts.\n\nThe Control Panel requires authentication, but only minimal permissions such as 'view entries' to delete entries or 'view users' to delete users are required. The REST and GraphQL API exploits do not require any permissions; however, they must be explicitly enabled with no authentication, and the specific resources must be enabled as well.", "risk_and_exploitability": "The CVSS score of 8.1 indicates high severity. EPSS is not available, and the vulnerability is not listed in CISA\u2019s KEV catalog, but the attack vector is clear: an attacker can manipulate query values or API calls to invoke arbitrary methods.\n\nControl Panel exploitation requires an authenticated user with minimal permissions, while REST and GraphQL exploitation is trivial if the endpoints are enabled without authentication. Given that these APIs are disabled by default, the risk is highest for sites that have them enabled or for sites that have been compromised and have legitimate credentials. Patching to the fixed releases is strongly recommended."}}}}, "created": "2026-04-22T22:30:28.629811+00:00", "updated": "2026-04-27T18:42:00.076353+00:00", "vendors": ["statamic", "statamic$PRODUCT$cms"]}