PT-2026-68977

Published

2026-08-06

·

Updated

2026-08-06

Description by

CVSS 3.1
6.5
Medium
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Impact

An authenticated Control Panel user could view content from entries they don't have permission to view, including entry content and custom field values, from any collection and including unpublished entries. No data could be modified.

Patches

This has been fixed in 5.74.1 and 6.24.0.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-862: Missing Authorization
CWE-639: Authorization Bypass Through User-Controlled Key
Related identifiers
GHSA-QH8C-7588-QFRV
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com