{"id":"CVE-2026-54244","title":"Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors","summary":"Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors","severity":"low","cvss":3.5,"cwe":["CWE-863"],"vendor":"statamic","product":"statamic/cms","ecosystem":"composer","affected":["statamic/cms < 5.74.0","statamic/cms >= 6.0.0, < 6.20.3"],"patched":["statamic/cms 5.74.0","statamic/cms 6.20.3"],"published":"2026-06-26","updated":"2026-06-26","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-7mqq-4v55-88gh","references":[{"url":"https://github.com/statamic/cms/security/advisories/GHSA-7mqq-4v55-88gh"},{"url":"https://github.com/advisories/GHSA-7mqq-4v55-88gh"}],"tags":["ghsa","composer"],"ingestedAt":"2026-06-29T13:24:35.076Z","epss":0.00303,"epssPercentile":0.23201,"slug":"CVE-2026-54244","body":"## Overview\n\n### Impact\n\nThe Live Preview endpoint for existing entries and terms only checked view authorization, but it accepts and renders caller-supplied field values. A Control Panel user with view but not edit permission could therefore submit content they were not authorized to author and generate a shareable Live Preview URL rendering it.\n\n### Patches\n\nThis has been fixed in 5.74.0 and 6.20.3.\n\n## Affected packages\n\n- `statamic/cms < 5.74.0`\n- `statamic/cms >= 6.0.0, < 6.20.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `statamic/cms 5.74.0`\n- `statamic/cms 6.20.3`","depth":"sunlit","depthScore":19,"depthScoreParts":{"impact":19.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}