CVE-2026-49288: Statamic CMS Information Disclosure Bug

CVE-2026-49288 Overview

CVE-2026-49288 is an information disclosure vulnerability in Statamic, a Laravel and Git powered content management system (CMS). The flaw affects Statamic versions prior to 5.73.23 and 6.20.0. An authenticated Control Panel user can view metadata and content for resources they lack permission to access. Exposed data includes entries, assets, users, roles, groups, and other configured resources. Depending on the resource type, attackers may obtain titles, custom field values, entry content, asset metadata, and confirmation of user, role, and group existence. The vulnerability does not permit modification of any data. The issue is tracked as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Authenticated low-privileged Control Panel users can read titles, custom field values, entry content, asset metadata, and the existence of users, roles, and groups they should not be authorized to see.

Affected Products

Statamic CMS versions prior to 5.73.23
Statamic CMS 6.x versions prior to 6.20.0
Laravel-based deployments using the Statamic Control Panel

Discovery Timeline

2026-06-19 - CVE-2026-49288 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-49288

Vulnerability Analysis

The vulnerability stems from missing authorization checks in the Statamic Control Panel when serving resource metadata and content. Authenticated users with valid Control Panel sessions can request resource data outside their assigned permission boundaries. The system returns the requested data without verifying that the requesting user holds the correct role, group, or per-resource permission. This allows horizontal disclosure across entries, assets, users, roles, and groups configured in the application. The flaw is read-only — attackers cannot create, modify, or delete affected resources. The exposed information can still aid follow-on attacks by revealing usernames, role names, internal taxonomies, and the structure of custom fields.

Root Cause

The root cause is broken access control [CWE-200] in the Control Panel resource handlers. Authorization policies enforced for user-facing views are not consistently applied to underlying metadata and content retrieval paths. As a result, permission boundaries defined in Statamic roles and groups are bypassed for read operations.

Attack Vector

Exploitation requires a valid authenticated Control Panel account with low privileges. The attacker interacts with the Control Panel over the network and issues requests for resources they should not be able to view. No user interaction from a victim is required, and complexity is low. The attack surface is limited to confidentiality — integrity and availability remain unaffected.

No verified public exploitation code is available. See the GitHub Security Advisory GHSA-2497-6pwj-pwg7 for the vendor's technical description.

Detection Methods for CVE-2026-49288

Indicators of Compromise

Control Panel access logs showing a single authenticated user enumerating many distinct resource identifiers in rapid succession.
HTTP requests to Control Panel endpoints returning resource metadata for entries, assets, users, roles, or groups that fall outside the requester's assigned scope.
Unexpected 200 OK responses on resource read endpoints from accounts that should receive 403 Forbidden.

Detection Strategies

Compare each authenticated Control Panel request against the requesting user's role and group assignments, and flag reads that cross those boundaries.
Baseline normal Control Panel read volume per user and alert on sudden spikes in resource enumeration.
Review web server and Laravel application logs for sequential identifier scanning patterns against Statamic Control Panel routes.

Monitoring Recommendations

Forward Statamic and Laravel application logs to a centralized log platform with field-level parsing of user, route, and resource identifiers.
Alert on Control Panel API calls from accounts with low role assignments touching administrative resource types such as users, roles, or groups.
Track failed-to-successful authorization ratio per user to detect probing behavior preceding successful disclosure.

How to Mitigate CVE-2026-49288

Immediate Actions Required

Upgrade Statamic to version 5.73.23 or 6.20.0 or later without delay.
Audit Control Panel user accounts and revoke unnecessary access, especially for low-trust or dormant accounts.
Rotate credentials for any Control Panel accounts suspected of unauthorized use during the exposure window.

Patch Information

Statamic addressed the issue in versions 5.73.23 and 6.20.0. The fix enforces consistent authorization checks across Control Panel resource read paths so that role and group permissions are validated before metadata or content is returned. Full advisory details are available in the GitHub Security Advisory GHSA-2497-6pwj-pwg7.

Workarounds

Restrict Control Panel access to trusted network ranges using a reverse proxy or web application firewall until patching is complete.
Minimize the number of authenticated Control Panel users and remove accounts that are not strictly required.
Review and tighten role and group definitions to limit the population of resources any single account could disclose if abused.

bash

# Upgrade Statamic via Composer to a patched release
composer require statamic/cms:^5.73.23 --update-with-dependencies
# or for the 6.x branch
composer require statamic/cms:^6.20.0 --update-with-dependencies
php artisan cache:clear
php artisan config:clear