~ / search / GHSA-qh8c-7588-qfrv

GHSA-qh8c-7588-qfrv

Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-64662

Packages

EcosystemPackageAffectedFixed in
Packagist statamic/cms < 5.74.1 5.74.1
Packagist statamic/cms >= 6.0.0, < 6.24.0 6.24.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact An authenticated Control Panel user could view content from entries they don't have permission to view, including entry content and custom field values, from any collection and including unpublished entries. No data could be modified. ### Patches This has been fixed in 5.74.1 and 6.24.0.

References

External links from the advisory. They lead to third-party sites.