PT-2026-53029 · Git+2 · Cms+1

CVE-2026-54244

·

Published

2026-06-26

·

Updated

2026-07-20

CVSS v3.1

3.5

Low

VectorAV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.74.0 Statamic versions prior to 6.20.3
Description The Live Preview endpoint for existing entries and terms in src/Http/Controllers/CP/PreviewController.php only verifies view authorization but accepts and renders field values supplied by the caller. This allows a Control Panel user who has view permissions but lacks edit permissions to submit unauthorized content and generate a shareable Live Preview URL that renders said content.
Recommendations Update to version 5.74.0 or later. Update to version 6.20.3 or later.

Exploit

Fix

Incorrect Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-54244
GHSA-7MQQ-4V55-88GH

Affected Products

Cms
Statamic Cms