CVE-2026-27939 PUBLISHED

Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass

Assigner: GitHub_M
Reserved: 25.02.2026 Published: 27.02.2026 Updated: 27.02.2026

Statmatic is a Laravel and Git powered content management system (CMS). Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel users may under certain conditions obtain elevated privileges without completing the intended verification step. This can allow access to sensitive operations and, depending on the user’s existing permissions, may lead to privilege escalation. This has been fixed in 6.4.0.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Product Status

Vendor statamic
Product cms
Versions
  • Version >= 6.0.0, < 6.4.0 is affected

References

Problem Types

  • CWE-287: Improper Authentication CWE