CVE-2026-33887: Statamic allows unauthorized content access through missing authorization in its revision controllers
Impact Authenticated Control Panel users could view entry revisions for any collection with revisions enabled, regardless of whether they had the required collection permissions. This bypasses the authorization checks that the main entry controllers enforce, exposing entry field values and blueprint data.
Users could also create entry revisions without edit permission, though this only snapshots the existing content state and does not affect published content.
Patches This has been fixed in 5.73.16 and 6.7.2.
Other sources
Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, authenticated Control Panel users could view entry revisions for any collection with revisions enabled, regardless of whether they had the required collection permissions. This bypasses the authorization checks that the main entry controllers enforce, exposing entry field values and blueprint data. Users could also create entry revisions without edit permission, though this only snapshots the existing content state and does not affect published content. This has been fixed in 5.73.16 and 6.7.2.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33887?
CVE-2026-33887 has a high severity rating due to the unauthorized access to entry revisions that could expose sensitive data.
How do I fix CVE-2026-33887?
To fix CVE-2026-33887, upgrade the Statamic CMS to versions 6.7.2 or 5.73.16 or later.
What impact does CVE-2026-33887 have on my system?
CVE-2026-33887 allows authenticated control panel users to bypass permissions and view entry revisions they should not have access to.
Which versions of Statamic CMS are affected by CVE-2026-33887?
CVE-2026-33887 affects Statamic CMS versions between 6.0.0-alpha.1 and 6.7.2, as well as all versions up to 5.73.16.
Are there any workarounds for CVE-2026-33887?
There are no documented workarounds for CVE-2026-33887; the recommended solution is to upgrade to the patched versions.