CVE-2026-54244

{
  "id": "CVE-2026-54244",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-17T21:17:08.523",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in src/Http/Controllers/CP/PreviewController.php only checked view authorization, but it accepts and renders caller-supplied field values. A Control Panel user with view but not edit permission could therefore submit content they were not authorized to author and generate a shareable Live Preview URL rendering it. This issue is fixed in versions 5.74.0 and 6.20.3."
    },
    {
      "lang": "es",
      "value": "Statamic es un sistema de gestión de contenido (CMS) impulsado por Laravel y Git. Antes de las versiones 5.74.0 y 6.20.3, el endpoint de Vista Previa en Vivo para entradas y términos existentes en src/HTTP/Controllers/CP/PreviewController.PHP solo verificaba la autorización de vista, pero acepta y renderiza valores de campo proporcionados por el llamador. Un usuario del Panel de Control con permiso de vista pero no de edición podría, por lo tanto, enviar contenido que no estaba autorizado a crear y generar una URL de Vista Previa en Vivo compartible que lo renderizara. Este problema está solucionado en las versiones 5.74.0 y 6.20.3."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "statamic",
          "product": "cms",
          "versions": [
            {
              "version": "< 5.74.0",
              "status": "affected"
            },
            {
              "version": ">= 6.0.0, < 6.20.3",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
          "baseScore": 3.5,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-20T18:51:53.445479Z",
          "id": "CVE-2026-54244",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/statamic/cms/commit/87b9998f4d9e40de53346402ccf6eb3c17ba168f",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/statamic/cms/pull/14791",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/statamic/cms/releases/tag/v5.74.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/statamic/cms/releases/tag/v6.20.3",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/statamic/cms/security/advisories/GHSA-7mqq-4v55-88gh",
      "source": "[email protected]"
    }
  ]
}