Feed/CVE-2026-64662
CVE-2026-64662MEDIUMCVSS 6.5

Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries

Published Aug 6, 2026·Updated Aug 6, 2026

NVD Description

### Impact An authenticated Control Panel user could view content from entries they don't have permission to view, including entry content and custom field values, from any collection and including unpublished entries. No data could be modified. ### Patches This has been fixed in 5.74.1 and 6.24.0.

Affected Packages (1)

statamic/cmsCOMPOSER
Fixed in 5.74.1

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Register your stack and get notified within minutes when a matching CVE drops.

Start monitoring free