CVE-2026-25633 Statamic's missing authorization allows access to assets

What is CVE-2026-25633?

CVE-2026-25633 is a medium-severity missing authorization vulnerability in statamic cms, published on 11 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Statamic is a, Laravel + Git powered CMS designed for building websites. Prior to 5.73.6 and 6.2.5, users without permission to view assets are able are able to download them and view their metadata. Logged-out users and users without permission to access the control panel are unable to take advantage of this. This has been fixed in 5.73.6 and 6.2.5.

Weakness: CWE-862

Which versions are affected by CVE-2026-25633?

4 open source packages ship an affected version, including statamic/cms. It affects 1 product.

Products include Statamic Statamic.

How do I fix CVE-2026-25633?

Upgrade statamic/cms to a fixed version for your release line: 5.73.6 or 6.2.5.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-25633 being exploited?

There is no known exploitation of CVE-2026-25633 in the wild and no public exploit code.

Other vulnerabilities in statamic cms

• CVE-2021-45364 Code injection in n/a Critical 9.8
• CVE-2026-27593 Statamic is vulnerable to account takeover via password reset link injection Critical 9.3
• CVE-2026-27939 Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass High 8.8
• CVE-2023-48217 Remote code execution via form uploads in statamic/cms High 8.8
• CVE-2017-11422 Statamic framework Incorrect Permission Assignment High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gwmx-9gcj-332h.