CVE-2026-54244

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54244", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-12T16:25:43.085Z", "datePublished": "2026-07-17T20:22:35.728Z", "dateUpdated": "2026-07-20T19:11:22.297Z"}, "containers": {"cna": {"title": "Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editors", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/statamic/cms/security/advisories/GHSA-7mqq-4v55-88gh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/statamic/cms/security/advisories/GHSA-7mqq-4v55-88gh"}, {"name": "https://github.com/statamic/cms/pull/14791", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/pull/14791"}, {"name": "https://github.com/statamic/cms/commit/87b9998f4d9e40de53346402ccf6eb3c17ba168f", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/commit/87b9998f4d9e40de53346402ccf6eb3c17ba168f"}, {"name": "https://github.com/statamic/cms/releases/tag/v5.74.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/releases/tag/v5.74.0"}, {"name": "https://github.com/statamic/cms/releases/tag/v6.20.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/releases/tag/v6.20.3"}], "affected": [{"vendor": "statamic", "product": "cms", "versions": [{"version": "< 5.74.0", "status": "affected"}, {"version": ">= 6.0.0, < 6.20.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-17T20:22:35.728Z"}, "descriptions": [{"lang": "en", "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in src/Http/Controllers/CP/PreviewController.php only checked view authorization, but it accepts and renders caller-supplied field values. A Control Panel user with view but not edit permission could therefore submit content they were not authorized to author and generate a shareable Live Preview URL rendering it. This issue is fixed in versions 5.74.0 and 6.20.3."}], "source": {"advisory": "GHSA-7mqq-4v55-88gh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-20T18:51:53.445479Z", "id": "CVE-2026-54244", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T19:11:22.297Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54244", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T18:51:53.445479Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T18:51:54.168Z"}}], "cna": {"title": "Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editors", "source": {"advisory": "GHSA-7mqq-4v55-88gh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "statamic", "product": "cms", "versions": [{"status": "affected", "version": "< 5.74.0"}, {"status": "affected", "version": ">= 6.0.0, < 6.20.3"}]}], "references": [{"url": "https://github.com/statamic/cms/security/advisories/GHSA-7mqq-4v55-88gh", "name": "https://github.com/statamic/cms/security/advisories/GHSA-7mqq-4v55-88gh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/statamic/cms/pull/14791", "name": "https://github.com/statamic/cms/pull/14791", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/statamic/cms/commit/87b9998f4d9e40de53346402ccf6eb3c17ba168f", "name": "https://github.com/statamic/cms/commit/87b9998f4d9e40de53346402ccf6eb3c17ba168f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/statamic/cms/releases/tag/v5.74.0", "name": "https://github.com/statamic/cms/releases/tag/v5.74.0", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/statamic/cms/releases/tag/v6.20.3", "name": "https://github.com/statamic/cms/releases/tag/v6.20.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in src/Http/Controllers/CP/PreviewController.php only checked view authorization, but it accepts and renders caller-supplied field values. A Control Panel user with view but not edit permission could therefore submit content they were not authorized to author and generate a shareable Live Preview URL rendering it. This issue is fixed in versions 5.74.0 and 6.20.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-17T20:22:35.728Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54244", "state": "PUBLISHED", "dateUpdated": "2026-07-20T19:11:22.297Z", "dateReserved": "2026-06-12T16:25:43.085Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-17T20:22:35.728Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "cms", "vendor": "statamic", "versions": [{"status": "affected", "version": "< 5.74.0"}, {"status": "affected", "version": ">= 6.0.0, < 6.20.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in src/Http/Controllers/CP/PreviewController.php only checked view authorization, but it accepts and renders caller-supplied field values. A Control Panel user with view but not edit permission could therefore submit content they were not authorized to author and generate a shareable Live Preview URL rendering it. This issue is fixed in versions 5.74.0 and 6.20.3."}, {"lang": "es", "value": "Statamic es un sistema de gesti\u00f3n de contenido (CMS) impulsado por Laravel y Git. Antes de las versiones 5.74.0 y 6.20.3, el endpoint de Vista Previa en Vivo para entradas y t\u00e9rminos existentes en src/HTTP/Controllers/CP/PreviewController.PHP solo verificaba la autorizaci\u00f3n de vista, pero acepta y renderiza valores de campo proporcionados por el llamador. Un usuario del Panel de Control con permiso de vista pero no de edici\u00f3n podr\u00eda, por lo tanto, enviar contenido que no estaba autorizado a crear y generar una URL de Vista Previa en Vivo compartible que lo renderizara. Este problema est\u00e1 solucionado en las versiones 5.74.0 y 6.20.3."}], "id": "CVE-2026-54244", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54244", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-20T18:51:53.445479Z", "version": "2.0.3"}}]}, "published": "2026-07-17T21:17:08.523", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/statamic/cms/commit/87b9998f4d9e40de53346402ccf6eb3c17ba168f"}, {"source": "security-advisories@github.com", "url": "https://github.com/statamic/cms/pull/14791"}, {"source": "security-advisories@github.com", "url": "https://github.com/statamic/cms/releases/tag/v5.74.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/statamic/cms/releases/tag/v6.20.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/statamic/cms/security/advisories/GHSA-7mqq-4v55-88gh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.74.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0.0,6.20.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "cms", "source": "cna", "vendor": "statamic"}, "product": "cms", "vendor": "statamic"}], "created": "2026-07-17T21:30:17.285283+00:00", "updated": "2026-07-30T23:30:08.690781+00:00", "vendors": ["statamic", "statamic$PRODUCT$cms"]}