CVE-2026-54244: Statamic CMS Auth Bypass Vulnerability

CVE-2026-54244 Overview

CVE-2026-54244 is an authorization flaw in Statamic, a Laravel and Git powered content management system (CMS). The Live Preview endpoint for existing entries and terms in src/Http/Controllers/CP/PreviewController.php verified only view authorization while accepting caller-supplied field values. A Control Panel user holding view but not edit permission could submit unauthorized content and generate a shareable Live Preview URL that renders it. The issue is classified as an incorrect authorization weakness [CWE-863] and is fixed in Statamic versions 5.74.0 and 6.20.3.

Critical Impact
Low-privileged Control Panel users can craft and share Live Preview URLs containing content they were not authorized to author.

Affected Products

Statamic CMS versions prior to 5.74.0
Statamic CMS 6.x versions prior to 6.20.3
Deployments exposing the Control Panel to users with view-only permissions on entries or terms

Discovery Timeline

2026-07-17 - CVE-2026-54244 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-54244

Vulnerability Analysis

Statamic exposes a Live Preview feature that renders in-progress content changes for authors. The PreviewController handles preview requests for existing entries and terms. The controller enforced only the view policy on the target resource before rendering the response.

Because the endpoint accepts arbitrary field values from the request body, any authenticated Control Panel user with view access could substitute their own content into the render pipeline. The resulting Live Preview URL is shareable, allowing the attacker to distribute rendered content they lacked authority to publish.

The practical impact is limited to integrity of preview-rendered content. Data confidentiality and availability are not directly affected, and user interaction is required to visit the generated URL.

Root Cause

The root cause is a missing edit-permission check in the Live Preview flow. The controller conflated read access with write access by accepting mutated field values under a view-only authorization gate. The frontend PublishForm.vue components also exposed the Live Preview button in read-only contexts, mirroring the server-side gap.

Attack Vector

An authenticated attacker with view but not edit permission submits a Live Preview request against an existing entry or term. The request body contains attacker-controlled field values. The server renders the preview using those values and returns a shareable URL that reflects the injected content to any recipient who opens it.

text

// Patch: resources/js/components/entries/PublishForm.vue
         },
 
         showLivePreviewButton() {
-            return !this.isCreating && this.isBase && this.livePreviewUrl;
+            return !this.readOnly && !this.isCreating && this.isBase && this.livePreviewUrl;
         },
 
         showVisitUrlButton() {

Source: Statamic commit 87b9998

The patch adds a !this.readOnly predicate so the Live Preview control is hidden when the user cannot edit. An equivalent fix is applied to resources/js/components/terms/PublishForm.vue, and the server-side authorization check in PreviewController is tightened in the same pull request.

Detection Methods for CVE-2026-54244

Indicators of Compromise

Live Preview HTTP requests to Statamic Control Panel preview endpoints originating from accounts that hold view-only roles on the targeted entry or term.
Unexpected external referrers or shares of /cp/.../preview URLs corresponding to entries the sharing user did not author.
Audit log entries showing preview renders whose submitted field payloads differ substantially from the stored entry data.

Detection Strategies

Correlate Control Panel role assignments with preview endpoint usage and alert when view-only accounts invoke the Live Preview handler.
Log full request bodies at the reverse proxy for PreviewController routes and compare submitted values against persisted content to identify mutation attempts.
Review Statamic user role changes and preview activity across the disclosure window between vulnerable releases and upgrade to 5.74.0 or 6.20.3.

Monitoring Recommendations

Enable Laravel request logging for Control Panel routes and forward logs to a centralized SIEM for retention and query.
Monitor for spikes in Live Preview URL generation from accounts that have no publish or edit history.
Track outbound sharing of Live Preview URLs through email gateways and collaboration platforms when the CMS is used for external communications.

How to Mitigate CVE-2026-54244

Immediate Actions Required

Upgrade Statamic to version 5.74.0 for the 5.x branch or 6.20.3 for the 6.x branch.
Review Control Panel role assignments and remove unnecessary view access on sensitive entries and taxonomies.
Rotate any shared Live Preview URLs that were generated by view-only users prior to patching.

Patch Information

The fix is delivered in Statamic release v5.74.0 and Statamic release v6.20.3. Details are published in GitHub Security Advisory GHSA-7mqq-4v55-88gh and implemented in Pull Request #14791. The change enforces edit-permission checks on the Live Preview endpoint and hides the preview control from read-only users.

Workarounds

Restrict Control Panel access at the network layer to trusted authors until the patch is applied.
Temporarily remove the view permission on entries and terms from users who do not require Control Panel access.
Disable Live Preview link sharing in downstream communication channels while the upgrade is scheduled.

bash

# Upgrade Statamic via Composer
composer require statamic/cms:^5.74.0 --update-with-dependencies
# or for the 6.x branch
composer require statamic/cms:^6.20.3 --update-with-dependencies
php artisan cache:clear