CVE-2026-64662

{
  "id": "CVE-2026-64662",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-06T22:18:13.673",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from entries they did not have permission to view, including entry content and custom field values, from any collection and including unpublished entries, through the navigation endpoint, though no data could be modified. This issue is fixed in versions 5.74.1 and 6.24.0."
    },
    {
      "lang": "es",
      "value": "Statamic es un sistema de gestión de contenido (CMS) impulsado por Laravel y Git. Antes de las versiones 5.74.1 y 6.24.0, un usuario autenticado del Panel de Control podía ver contenido de entradas para las que no tenía permiso de visualización, incluyendo el contenido de la entrada y los valores de campos personalizados, de cualquier colección e incluyendo entradas no publicadas, a través del punto final de navegación, aunque no se podían modificar datos. Este problema está solucionado en las versiones 5.74.1 y 6.24.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "statamic",
          "product": "cms",
          "versions": [
            {
              "version": "< 5.74.1",
              "status": "affected"
            },
            {
              "version": ">= 6.0.0, < 6.24.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-07T16:05:54.213057Z",
          "id": "CVE-2026-64662",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/statamic/cms/commit/6557f1d8a0d61c0e7ad9c9a8f42cb3288607495d",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/statamic/cms/pull/14906",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/statamic/cms/releases/tag/v5.74.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/statamic/cms/releases/tag/v6.24.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/statamic/cms/security/advisories/GHSA-qh8c-7588-qfrv",
      "source": "[email protected]"
    }
  ]
}