CVE-2026-33177 Statamic is missing authorization check on taxonomy term creation via fieldtype
Low-privileged users can bypass authorization checks to create taxonomy terms in Statamic CMS via field action endpoints.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33177?
CVE-2026-33177 is a medium-severity missing authorization vulnerability in statamic cms, published on 20 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action processing endpoint with attacker-controlled field definitions. This bypasses the authorization checks enforced on the standard taxonomy term creation endpoint. This has been fixed in 5.73.14 and 6.7.0.
Weakness: CWE-862
Which versions are affected by CVE-2026-33177?
4 open source packages ship an affected version, including statamic/cms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
statamic/cms Packagist | All versions | 5.73.14 |
statamic/cms Packagist | All versions | 5.73.14 |
statamic/cms Packagist | From 6.0.0-alpha.1 | 6.7.0 |
statamic/cms Packagist | From 6.0.0-alpha.1 | 6.7.0 |
Products include Statamic Statamic.
How do I fix CVE-2026-33177?
Upgrade statamic/cms to a fixed version for your release line: 5.73.14 or 6.7.0.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-33177 being exploited?
There is no known exploitation of CVE-2026-33177 in the wild and no public exploit code.
Other vulnerabilities in statamic cms
- CVE-2021-45364 Code injection in n/a
- CVE-2026-27593 Statamic is vulnerable to account takeover via password reset link injection
- CVE-2026-27939 Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass
- CVE-2023-48217 Remote code execution via form uploads in statamic/cms
- CVE-2017-11422 Statamic framework Incorrect Permission Assignment
Sources
Also known as GHSA-wh3h-gvc4-cc2g.