CVE-2026-33884 Statamic's live preview token bypasses content protection for unrelated entries

What is CVE-2026-33884?

CVE-2026-33884 is a medium-severity missing authorization vulnerability in statamic cms, published on 27 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, an authenticated Control Panel user with access to live preview could use a live preview token to access restricted content that the token was not intended for. This has been fixed in 5.73.16 and 6.7.2.

Weakness: CWE-863

Which versions are affected by CVE-2026-33884?

4 open source packages ship an affected version, including statamic/cms. It affects 1 product.

Products include Statamic Statamic.

How do I fix CVE-2026-33884?

Upgrade statamic/cms to a fixed version for your release line: 5.73.16 or 6.7.2.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-33884 being exploited?

There is no known exploitation of CVE-2026-33884 in the wild and no public exploit code.

Other vulnerabilities in statamic cms

• CVE-2021-45364 Code injection in n/a Critical 9.8
• CVE-2026-27593 Statamic is vulnerable to account takeover via password reset link injection Critical 9.3
• CVE-2026-27939 Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass High 8.8
• CVE-2023-48217 Remote code execution via form uploads in statamic/cms High 8.8
• CVE-2017-11422 Statamic framework Incorrect Permission Assignment High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8vwx-ccf6-5wg2.