GHSA-qh8c-7588-qfrv: Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries
Impact
An authenticated Control Panel user could view content from entries they don't have permission to view, including entry content and custom field values, from any collection and including unpublished entries. No data could be modified.
Patches
This has been fixed in 5.74.1 and 6.24.0.
Details
Original advisory: https://github.com/advisories/GHSA-qh8c-7588-qfrv
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-64662 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
More from GitHub Security Advisories
- mediumGHSA-957r-qf9p-67xw: Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts2026-08-06
- mediumGHSA-6hr6-w5qg-qmwg: h2: Duplicate Host header could facilitate request smuggling2026-08-06
- mediumGHSA-596p-6jv8-775v: Craft CMS: Authenticated leak of secret environment variables2026-08-06
- mediumGHSA-rvmm-v933-jgxq: Craft CMS: Missing authorization check allows non-admin control panel users access to use…2026-08-06
- lowGHSA-7hxc-f267-h5q7: Craft CMS: Incorrect path validation could potentially lead to path traversal2026-08-06