CVE-2026-32612: Statamic CMS Stored XSS Vulnerability

CVE-2026-32612 Overview

CVE-2026-32612 is a stored cross-site scripting (XSS) vulnerability in Statamic, a Laravel and Git powered content management system (CMS). The flaw exists in the control panel color mode preference setting in versions prior to 6.6.2. Authenticated users with control panel access can inject malicious JavaScript into the preference value. The payload executes when a higher-privileged user impersonates the attacker's account, enabling privilege escalation in the administrative interface. Statamic addressed the issue in version 6.6.2.

Critical Impact
Authenticated low-privilege users can inject persistent JavaScript that executes in a higher-privileged administrator's browser session during account impersonation, enabling session theft or unauthorized administrative actions.

Affected Products

Statamic CMS versions prior to 6.6.2
Laravel-based deployments using the Statamic control panel
Installations exposing impersonation features to administrators

Discovery Timeline

2026-03-13 - CVE-2026-32612 published to NVD
2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-32612

Vulnerability Analysis

The vulnerability is a stored cross-site scripting issue tracked under [CWE-79]. Statamic stores user interface preferences, including the control panel color mode, on a per-user basis. The application fails to sanitize or properly encode the color mode preference value before rendering it in the control panel UI. An authenticated user with control panel access can set the preference to a value containing JavaScript. The malicious payload persists in the user's profile and is delivered whenever the preference is rendered.

The exploitation chain depends on Statamic's user impersonation feature. When a higher-privileged user, such as an administrator, impersonates the affected account, the malicious script executes in the administrator's authenticated browser session. This crosses a trust boundary and grants the attacker the ability to perform actions as the administrator.

Root Cause

The root cause is missing output encoding of a user-controlled preference value before injection into the rendered HTML or JavaScript context of the control panel. Statamic treated the color mode preference as trusted data rather than untrusted input requiring contextual escaping.

Attack Vector

The attack vector is network-based and requires low privileges plus user interaction. An attacker logs in with any account that has control panel access, sets a crafted color mode preference, and waits for a higher-privileged user to impersonate the account. The scope changes when execution shifts from the attacker's context to the administrator's context. Technical details are described in the GitHub Security Advisory GHSA-hcch-w73c-jp4m.

Detection Methods for CVE-2026-32612

Indicators of Compromise

User preference records containing HTML tags, <script> elements, or JavaScript URI schemes in the color mode field
Unexpected administrator actions originating from sessions that recently used the impersonation feature
Browser console errors or content security policy violations triggered when loading the control panel
Outbound HTTP requests from the control panel to attacker-controlled domains

Detection Strategies

Audit the Statamic user preferences storage for non-standard values in the color mode field, which should only contain values such as light, dark, or auto
Review web server access logs for POST requests to preference update endpoints containing script tags or encoded JavaScript payloads
Inspect impersonation audit logs and correlate them with subsequent privileged actions performed by the impersonating administrator

Monitoring Recommendations

Enable verbose logging on the Statamic control panel and forward events to a centralized SIEM for correlation
Deploy a Content Security Policy with script-src restrictions to limit execution of inline scripts in the control panel
Monitor for changes to user preference fields and alert on values that do not match an expected allowlist

How to Mitigate CVE-2026-32612

Immediate Actions Required

Upgrade Statamic to version 6.6.2 or later without delay
Review all user accounts with control panel access and audit their preference values for suspicious content
Restrict use of the impersonation feature until the patch is applied and accounts are verified clean
Rotate session tokens and credentials for any administrator who recently impersonated lower-privileged users

Patch Information

Statamic released version 6.6.2 to remediate CVE-2026-32612. The fix introduces proper sanitization and output encoding for the color mode preference value. Refer to the Statamic Security Advisory GHSA-hcch-w73c-jp4m and the supplementary CVE advisory for upgrade guidance.

Workarounds

Temporarily disable the user impersonation feature for administrators until the upgrade is completed
Limit control panel access to trusted users only and reduce the number of accounts with write access to preferences
Enforce a strict Content Security Policy that blocks inline script execution within the control panel routes

bash

# Configuration example
composer require statamic/cms:^6.6.2
php artisan cache:clear
php artisan config:clear