CVE-2026-33177: Statamic is missing authorization check on taxonomy term creation via fieldtype
Impact
Low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action processing endpoint with attacker-controlled field definitions. This bypasses the authorization checks enforced on the standard taxonomy term creation endpoint.
Patches
This has been fixed in 5.73.14 and 6.7.0.
Other sources
Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action processing endpoint with attacker-controlled field definitions. This bypasses the authorization checks enforced on the standard taxonomy term creation endpoint. This has been fixed in 5.73.14 and 6.7.0.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33177?
CVE-2026-33177 has a severity rating of low.
How do I fix CVE-2026-33177?
To fix CVE-2026-33177, upgrade to Statamic version 5.73.14 or 6.7.0.
Who is affected by CVE-2026-33177?
Low-privileged Control Panel users in Statamic are affected by CVE-2026-33177.
What does CVE-2026-33177 exploit?
CVE-2026-33177 exploits missing authorization checks during the creation of taxonomy terms.
What type of vulnerability is CVE-2026-33177?
CVE-2026-33177 is a security vulnerability related to improper authorization in the Statamic CMS.