CVE-2026-49288

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.73.23 Statamic versions prior to 6.20.0

Description An authenticated Control Panel user can view metadata and content for resources they lack permission to access. This includes entries, assets, users, roles, groups, and other configured resources. Depending on the resource, exposed information may include titles, custom field values, entry content, asset metadata, and the existence of users, roles, and groups. No data can be modified through this issue.

Recommendations Update to version 5.73.23 Update to version 6.20.0