CVE-2026-33884: Statamic CMS Auth Bypass Vulnerability

CVE-2026-33884 Overview

CVE-2026-33884 is an authorization bypass vulnerability (CWE-863) affecting Statamic, a Laravel and Git powered content management system (CMS). Authenticated Control Panel users with access to the live preview feature could exploit live preview tokens to access restricted content that the token was not intended to authorize. This broken access control issue allows unauthorized information exposure within the CMS environment.

Critical Impact

Authenticated users can bypass content restrictions through live preview token misuse, potentially exposing sensitive or restricted content to unauthorized parties within the organization.

Affected Products

• Statamic CMS versions prior to 5.73.16
• Statamic CMS versions prior to 6.7.2

Discovery Timeline

• 2026-03-27 - CVE-2026-33884 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-33884

Vulnerability Analysis

This vulnerability falls under CWE-863 (Incorrect Authorization), where the application fails to properly validate whether a live preview token should grant access to specific content. The flaw exists in the token validation logic of Statamic's live preview functionality, allowing authenticated users to manipulate or reuse tokens to view content beyond their intended authorization scope.

The attack requires network access and authenticated user privileges within the Statamic Control Panel. While user interaction is not required, the attacker must have legitimate access to the live preview feature. The impact is limited to confidentiality, with no direct integrity or availability implications.

Root Cause

The root cause stems from improper authorization checks when validating live preview tokens. The system failed to adequately verify that the token being used was specifically issued for the content being accessed. This allowed authenticated users to leverage valid tokens to circumvent content access restrictions, accessing entries or content they should not have permission to view.

Attack Vector

The attack vector is network-based, requiring an authenticated session with access to the Statamic Control Panel's live preview functionality. An attacker with low-privilege access could:

1. Obtain a valid live preview token for content they are authorized to view
2. Manipulate the token or request parameters to access different content entries
3. Retrieve restricted content that should be protected from their user role

The vulnerability does not require any user interaction from the victim and can be exploited directly by the authenticated attacker. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-33884

Indicators of Compromise

• Unusual patterns of live preview token usage across different content entries
• Access logs showing a single user requesting previews for content outside their normal scope
• Multiple preview requests with token reuse for different content IDs
• Unexpected content access patterns from authenticated Control Panel users

Detection Strategies

• Monitor Statamic application logs for live preview token usage anomalies
• Implement audit logging for all content access through the preview system
• Cross-reference user permissions with content access events in live preview
• Alert on users accessing preview content they don't have standard permissions for

Monitoring Recommendations

• Enable verbose logging for the Statamic Control Panel authentication and authorization events
• Deploy web application firewall (WAF) rules to detect suspicious preview token manipulation
• Review access logs regularly for users accessing content categories outside their role
• Integrate Statamic logs with SIEM solutions for centralized monitoring and alerting

How to Mitigate CVE-2026-33884

Immediate Actions Required

• Upgrade Statamic CMS to version 5.73.16 or later for the 5.x branch
• Upgrade Statamic CMS to version 6.7.2 or later for the 6.x branch
• Audit recent live preview access logs to identify potential exploitation
• Review user permissions and restrict live preview access to necessary personnel only

Patch Information

Statamic has released security patches addressing this authorization bypass vulnerability. Organizations should upgrade to the patched versions immediately:

• Version 5.x: Upgrade to 5.73.16 or later
• Version 6.x: Upgrade to 6.7.2 or later

Detailed patch information is available in the GitHub Security Advisory.

Workarounds

• Temporarily disable the live preview feature for non-essential users until patching is complete
• Implement additional access controls at the web server or reverse proxy level
• Restrict Control Panel access to trusted IP addresses only
• Review and minimize the number of users with live preview permissions

# Configuration example
# Restrict Control Panel access via .htaccess or web server configuration
# Example nginx configuration to limit CP access by IP
location /cp {
    allow 10.0.0.0/8;
    allow 192.168.1.0/24;
    deny all;
}