CVE-2026-33887

{
  "id": "CVE-2026-33887",
  "sourceIdentifier": "[email protected]",
  "published": "2026-03-27T21:17:25.647",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, authenticated Control Panel users could view entry revisions for any collection with revisions enabled, regardless of whether they had the required collection permissions. This bypasses the authorization checks that the main entry controllers enforce, exposing entry field values and blueprint data. Users could also create entry revisions without edit permission, though this only snapshots the existing content state and does not affect published content. This has been fixed in 5.73.16 and 6.7.2."
    },
    {
      "lang": "es",
      "value": "Statamic es un sistema de gestión de contenido (CMS) impulsado por Laravel y Git. Antes de las versiones 5.73.16 y 6.7.2, los usuarios autenticados del Panel de Control podían ver las revisiones de entradas para cualquier colección con revisiones habilitadas, independientemente de si tenían los permisos de colección requeridos. Esto elude las comprobaciones de autorización que los controladores de entrada principales aplican, exponiendo los valores de los campos de entrada y los datos de esquema. Los usuarios también podían crear revisiones de entradas sin permiso de edición, aunque esto solo captura el estado del contenido existente y no afecta al contenido publicado. Esto ha sido corregido en 5.73.16 y 6.7.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "statamic",
          "product": "cms",
          "versions": [
            {
              "version": "< 5.73.16",
              "status": "affected"
            },
            {
              "version": ">= 6.0.0-alpha.1, < 6.7.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-03-30T18:54:14.725865Z",
          "id": "CVE-2026-33887",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "5.73.16",
              "matchCriteriaId": "EACDC143-742E-4926-9C28-6095690EB549"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.0.0",
              "versionEndExcluding": "6.7.2",
              "matchCriteriaId": "631FF065-0872-4DC7-AB25-AB74B782A9BE"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/statamic/cms/security/advisories/GHSA-4hp7-3wxg-cv9q",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}