CVE-2026-54244

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.74.0 Statamic versions prior to 6.20.3

Description The Live Preview endpoint for existing entries and terms in src/Http/Controllers/CP/PreviewController.php only verifies view authorization but accepts and renders field values supplied by the caller. This allows a Control Panel user who has view permissions but lacks edit permissions to submit unauthorized content and generate a shareable Live Preview URL that renders said content.

Recommendations Update to version 5.74.0 or later. Update to version 6.20.3 or later.