GHSA-7mqq-4v55-88gh
Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | statamic/cms | < 5.74.0 | 5.74.0 |
| Packagist | statamic/cms | >= 6.0.0, < 6.20.3 | 6.20.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
The Live Preview endpoint for existing entries and terms only checked view authorization, but it accepts and renders caller-supplied field values. A Control Panel user with view but not edit permission could therefore submit content they were not authorized to author and generate a shareable Live Preview URL rendering it.
### Patches
This has been fixed in 5.74.0 and 6.20.3.
References
External links from the advisory. They lead to third-party sites.