Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2026-33884

Statamic's live preview token bypasses content protection for unrelated entries

Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, an authenticated Control Panel user with access to live preview could use a live preview token to access restricted content that the token was not intended for. This has been fixed in 5.73.16 and 6.7.2.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

statamic cms

  • < 5.73.16affected
  • >= 6.0.0-alpha.1, < 6.7.2affected

References