CVE-2026-25633: Statamic CMS Information Disclosure Flaw

CVE-2026-25633 Overview

CVE-2026-25633 is a Missing Authorization vulnerability (CWE-862) affecting Statamic, a Laravel + Git powered CMS designed for building websites. Prior to versions 5.73.6 and 6.2.5, users without permission to view assets are able to download them and view their metadata. This authorization bypass allows authenticated users with control panel access to access assets they should not have permission to view.

Critical Impact

Authenticated control panel users can bypass asset permission controls to download restricted files and view their metadata, potentially exposing sensitive content to unauthorized internal users.

Affected Products

• Statamic CMS versions prior to 5.73.6
• Statamic CMS versions prior to 6.2.5

Discovery Timeline

• 2026-02-11 - CVE-2026-25633 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2026-25633

Vulnerability Analysis

This vulnerability represents a classic Broken Access Control issue where the application fails to properly enforce authorization checks on asset endpoints. The Statamic CMS control panel contains functionality for managing and accessing media assets, but the authorization middleware does not adequately verify that authenticated users have the specific permission to view assets before allowing downloads or metadata retrieval.

The attack surface is limited to authenticated users who already have access to the Statamic control panel. Logged-out users and users without control panel access cannot exploit this vulnerability. However, within organizations using Statamic with granular permission structures, this could allow lower-privileged content editors to access assets reserved for administrators or other restricted user roles.

Root Cause

The root cause is missing authorization checks (CWE-862) in the asset handling endpoints. When a request is made to download an asset or retrieve its metadata, the system validates that the user is authenticated and has control panel access, but fails to verify the user's specific asset viewing permissions before serving the content.

Attack Vector

The vulnerability is exploitable over the network by any authenticated user with control panel access. An attacker would need valid credentials to the Statamic control panel, then could directly access asset URLs or API endpoints to retrieve files and metadata that their user role should not permit them to view.

The exploitation does not require user interaction and can be performed with low complexity. The impact is limited to confidentiality, as the attacker can only read assets—they cannot modify or delete them through this vulnerability.

Detection Methods for CVE-2026-25633

Indicators of Compromise

• Unusual asset download patterns from users who should not have asset permissions
• Access logs showing asset retrieval by user accounts with restricted roles
• API requests to asset endpoints from users not assigned to asset management groups
• Metadata queries for assets outside a user's assigned content areas

Detection Strategies

• Review access logs for asset downloads and compare against user permission assignments
• Implement alerting on asset access from users who lack explicit asset viewing permissions
• Monitor for bulk asset downloads or systematic enumeration patterns from single user sessions
• Audit user roles and permissions to identify accounts that may have exploited this issue

Monitoring Recommendations

• Enable detailed logging for all asset access operations in the Statamic control panel
• Configure alerts for access patterns that deviate from normal user behavior
• Regularly audit user permissions against actual asset access patterns
• Implement session monitoring to detect systematic asset enumeration attempts

How to Mitigate CVE-2026-25633

Immediate Actions Required

• Upgrade Statamic CMS to version 5.73.6 or later for 5.x installations
• Upgrade Statamic CMS to version 6.2.5 or later for 6.x installations
• Review access logs to identify potential exploitation of this vulnerability
• Audit user permissions to ensure principle of least privilege is enforced

Patch Information

Statamic has released patched versions that address this authorization bypass vulnerability:

• Version 5.73.6: GitHub Release v5.73.6
• Version 6.2.5: GitHub Release v6.2.5

The security fix is documented in the GitHub Security Advisory GHSA-gwmx-9gcj-332h and the specific code changes can be reviewed in the commit 5a6f47246edf3a0c453727ffecbfa14333a6bc8a.

Workarounds

• Restrict control panel access to only users who require it while awaiting upgrade
• Review and minimize user accounts with control panel access
• Implement network-level access controls to limit control panel exposure
• Monitor asset access patterns to detect potential abuse until patches are applied

# Update Statamic CMS via Composer
composer update statamic/cms

# Verify installed version after update
composer show statamic/cms | grep versions