CVE-2026-25633: Statamic's missing authorization allows access to assets
Impact Users without permission to view assets are able are able to download them and view their metadata.
Logged-out users and users without permission to access the control panel are unable to take advantage of this.
Patches This has been fixed in 5.73.6 and 6.2.5.
Other sources
Statamic is a, Laravel + Git powered CMS designed for building websites. Prior to 5.73.6 and 6.2.5, users without permission to view assets are able are able to download them and view their metadata. Logged-out users and users without permission to access the control panel are unable to take advantage of this. This has been fixed in 5.73.6 and 6.2.5.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25633?
CVE-2026-25633 is considered a moderate severity vulnerability affecting unauthorized access to asset downloads and metadata.
How do I fix CVE-2026-25633?
You can fix CVE-2026-25633 by updating your Statamic CMS to version 5.73.6 or 6.2.5.
Which versions of Statamic CMS are affected by CVE-2026-25633?
CVE-2026-25633 affects Statamic CMS versions prior to 5.73.6 and 6.2.5.
Who is impacted by CVE-2026-25633?
Users without permission to view assets can exploit CVE-2026-25633 to download and view metadata.
Is authentication required to exploit CVE-2026-25633?
No, logged-out users and users without control panel access cannot exploit CVE-2026-25633.