CyberRota Analysis
AI-GeneratedAuthenticated users of Statamic prior to versions 5.74.1 and 6.24.0 can access unauthorized content, including unpublished entries and custom field values, through the navigation endpoint. While this vulnerability does not allow data modification, it poses a risk of exposing sensitive information. Organizations using affected versions of Statamic should prioritize upgrading to the patched versions to mitigate potential information leakage.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from entries they did not have permission to view, including entry content and custom field values, from any collection and including unpublished entries, through the navigation endpoint, though no data could be modified. This issue is fixed in versions 5.74.1 and 6.24.0.