CVE-2026-41175: Statamic: Unsafe method invocation via query value resolution allows data destruction
Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.20 and 6.13.0, manipulating query parameters on Control Panel and REST API endpoints, or arguments in GraphQL queries, could result in the loss of content, assets, and user accounts. The Control Panel requires authentication with minimal permissions in order to exploit. e.g. "view entries" permission to delete entries, or "view users" permission to delete users, etc. The REST and GraphQL API exploits do not require any permissions, however neither are enabled by default. In order to be exploited, they would need to be explicitly enabled with no authentication configured, and the specific resources enabled too. Sites that enable the REST or GraphQL API without authentication should treat patching as critical priority. This has been fixed in 5.73.20 and 6.13.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41175?
CVE-2026-41175 has a high severity rating due to its potential for data destruction through unsafe method invocations.
How do I fix CVE-2026-41175?
To fix CVE-2026-41175, upgrade your Statamic installation to version 5.73.20 or later, or to version 6.13.0 or later.
What versions of Statamic are affected by CVE-2026-41175?
CVE-2026-41175 affects Statamic versions prior to 5.73.20 and 6.13.0.
What types of endpoints are vulnerable in CVE-2026-41175?
CVE-2026-41175 affects the control panel and REST API endpoints, as well as GraphQL queries.
Is there any workaround for CVE-2026-41175?
There are no official workarounds for CVE-2026-41175, so upgrading to the latest version is necessary for security.