GHSA-qh8c-7588-qfrv: Medium severity composer/statamic/cms vulnerability
Published Aug 6, 2026
·Updated
Impact
An authenticated Control Panel user could view content from entries they don't have permission to view, including entry content and custom field values, from any collection and including unpublished entries. No data could be modified.
Patches
This has been fixed in 5.74.1 and 6.24.0.
Affected Software
2 affected componentsFixes available
composer/statamic/cms>=6.0.0<6.24.0
6.24.0
composer/statamic/cms<5.74.1
5.74.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/statamic/cmsto a version that resolves this vulnerability.Fixed in 6.24.0 - Upgrade
Upgrade
composer/statamic/cmsto a version that resolves this vulnerability.Fixed in 5.74.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.74.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.24.0
Event History
Aug 6, 2026
Advisory Published
via GitHub·07:30 PM
Data Sourced
via GitHub·07:30 PM
DescriptionSeverityWeaknessAffected Software