CVE-2026-32612: Statamic CMS Stored XSS Vulnerability

CVE-2026-32612 Overview

CVE-2026-32612 is a stored Cross-Site Scripting (XSS) vulnerability in Statamic, a Laravel and Git powered content management system (CMS). Prior to version 6.6.2, the control panel color mode preference is vulnerable to stored XSS, allowing authenticated users with control panel access to inject malicious JavaScript that executes when a higher-privileged user impersonates their account. This vulnerability enables privilege escalation through user impersonation features.

Critical Impact

Authenticated attackers can inject persistent JavaScript payloads that execute in the context of administrators or other privileged users when they use the impersonation feature, potentially leading to account takeover, data theft, or further system compromise.

Affected Products

• Statamic CMS versions prior to 6.6.2
• Statamic control panel with user impersonation functionality enabled
• Laravel-based Statamic installations with multi-user configurations

Discovery Timeline

• 2026-03-13 - CVE-2026-32612 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-32612

Vulnerability Analysis

This stored XSS vulnerability exists in the Statamic control panel's color mode preference functionality. The root issue stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), where user-supplied input in the color mode preference field is not properly sanitized before being rendered in the browser context.

The attack scenario is particularly concerning because it leverages Statamic's user impersonation feature—a common administrative function that allows privileged users to log in as another user for troubleshooting or support purposes. When an administrator impersonates a lower-privileged user who has injected malicious JavaScript into their color mode preference, the script executes with the administrator's session context.

This vulnerability requires user interaction (the administrator must impersonate the attacker's account) and affects confidentiality and integrity of the system. The scope is changed, meaning the vulnerable component (color mode preference) impacts resources beyond its security scope when the malicious payload executes in the administrator's browser session.

Root Cause

The vulnerability originates from insufficient input validation and output encoding in the color mode preference handling within the Statamic control panel. User-supplied values are stored directly in the database and subsequently rendered in HTML context without proper sanitization, allowing script injection through the preference value.

Attack Vector

The attack leverages a network-accessible vector requiring low privileges (any authenticated control panel user) and user interaction from a higher-privileged account. The attack chain involves:

1. An authenticated user with basic control panel access modifies their color mode preference
2. Instead of a legitimate value, they inject a malicious JavaScript payload
3. The payload is stored persistently in the application database
4. When an administrator uses the impersonation feature to access the attacker's account, the stored XSS payload executes
5. The malicious script runs in the administrator's browser session, potentially capturing session tokens, modifying application settings, or performing actions on behalf of the administrator

The vulnerability mechanism involves improper handling of user preferences in the Statamic control panel. When preferences are rendered in the browser, the color mode value is inserted into the page without adequate HTML entity encoding or Content Security Policy enforcement. Attackers can craft payloads that include event handlers or script tags to achieve code execution. For detailed technical analysis, refer to the GitHub Security Advisory GHSA-hcch-w73c-jp4m.

Detection Methods for CVE-2026-32612

Indicators of Compromise

• Unusual JavaScript content in user preference fields within the Statamic database
• Control panel user preferences containing HTML tags, script elements, or event handlers
• Unexpected outbound network requests originating from administrator browser sessions
• Audit logs showing preference modifications with suspicious encoded or obfuscated content

Detection Strategies

• Implement content inspection on user preference fields to identify JavaScript syntax patterns, HTML tags, or URL-encoded script content
• Deploy Web Application Firewall (WAF) rules to detect and block XSS payloads in POST requests to preference endpoints
• Enable browser-based XSS auditors and Content Security Policy reporting to capture execution attempts
• Review database entries in user preference tables for values exceeding expected lengths or containing non-alphanumeric characters

Monitoring Recommendations

• Configure centralized logging for all control panel preference modifications with full request body capture
• Set up alerts for impersonation events preceded by recent preference changes on the target account
• Monitor for anomalous administrative actions occurring during or shortly after impersonation sessions
• Implement SentinelOne Singularity XDR to detect post-exploitation behaviors such as credential harvesting or lateral movement attempts

How to Mitigate CVE-2026-32612

Immediate Actions Required

• Upgrade Statamic CMS to version 6.6.2 or later immediately
• Audit all existing user preferences in the database for malicious JavaScript content
• Review control panel access logs for any suspicious preference modification activity
• Consider temporarily disabling the user impersonation feature until the patch is applied
• Implement Content Security Policy headers to mitigate XSS impact

Patch Information

Statamic has released version 6.6.2 which addresses this stored XSS vulnerability. The fix implements proper input validation and output encoding for the color mode preference field. Administrators should update their Statamic installation using Composer:

composer update statamic/cms

For additional details, consult the GitHub Security Advisory GHSA-hcch-w73c-jp4m and the CVE-2026-32612 Advisory.

Workarounds

• Restrict control panel access to trusted users only until the patch can be applied
• Implement a Web Application Firewall with XSS detection rules to filter malicious input
• Disable or limit the user impersonation feature to reduce the attack surface
• Deploy Content Security Policy headers with strict script-src directives to prevent inline script execution

# Example CSP header configuration for Apache
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self';"

# Example CSP header configuration for Nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self';";