CVE-2026-54244 Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editors
View-only users can submit unauthorized content via Live Preview, bypassing edit restrictions in Statamic CMS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-54244?
CVE-2026-54244 is a low-severity missing authorization vulnerability in statamic cms, published on 17 Jul 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in src/Http/Controllers/CP/PreviewController.php only checked view authorization, but it accepts and renders caller-supplied field values. A Control Panel user with view but not edit permission could therefore submit content they were not authorized to author and generate a shareable Live Preview URL rendering it. This issue is fixed in versions 5.74.0 and 6.20.3.
Weakness: CWE-863
Which versions are affected by CVE-2026-54244?
4 open source packages ship an affected version, including statamic/cms.
| Package | Affected | Fixed in |
|---|---|---|
statamic/cms Packagist | All versions | 5.74.0 |
statamic/cms Packagist | All versions | 5.74.0 |
statamic/cms Packagist | From 6.0.0 | 6.20.3 |
statamic/cms Packagist | From 6.0.0 | 6.20.3 |
How do I fix CVE-2026-54244?
Upgrade statamic/cms to a fixed version for your release line: 5.74.0 or 6.20.3.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-54244 being exploited?
There is no known exploitation of CVE-2026-54244 in the wild and no public exploit code.
Sources
Also known as GHSA-7mqq-4v55-88gh.