CVE-2026-64662

mediumCVSS 6.5covered by 2 sourcesfirst seen 2026-08-06

Impact An authenticated Control Panel user could view content from entries they don't have permission to view, including entry content and custom field values, from any collection and including unpublished entries. No data could be modified. Patches This has been fixed in 5.74.1 and 6.24.0.

⚡ Watch CVE-2026-64662

Get an email if CVE-2026-64662 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (2)

mediumCVE-2026-64662: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.2…nvd · 2026-08-06
mediumGHSA-qh8c-7588-qfrv: Statamic: Missing authorization on navigation endpoint allows disclosure of restricted en…ghsa · 2026-08-06

External references

NVD record for CVE-2026-64662

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-64662 status](https://www.csirts.com/badge/CVE-2026-64662)](https://www.csirts.com/cve/CVE-2026-64662)