---
id: CVE-2026-54244
title: >-
  Statamic CMS's incorrect authorization lets view-only users submit Live
  Preview content reserved for editors
summary: >-
  Statamic CMS's incorrect authorization lets view-only users submit Live
  Preview content reserved for editors
severity: low
cvss: 3.5
cwe:
  - CWE-863
vendor: statamic
product: statamic/cms
ecosystem: composer
affected:
  - statamic/cms < 5.74.0
  - 'statamic/cms >= 6.0.0, < 6.20.3'
patched:
  - statamic/cms 5.74.0
  - statamic/cms 6.20.3
published: '2026-06-26'
updated: '2026-06-26'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-7mqq-4v55-88gh'
references:
  - url: 'https://github.com/statamic/cms/security/advisories/GHSA-7mqq-4v55-88gh'
  - url: 'https://github.com/advisories/GHSA-7mqq-4v55-88gh'
tags:
  - ghsa
  - composer
ingestedAt: '2026-06-29T13:24:35.076Z'
epss: 0.00303
epssPercentile: 0.20509
---

## Overview

### Impact

The Live Preview endpoint for existing entries and terms only checked view authorization, but it accepts and renders caller-supplied field values. A Control Panel user with view but not edit permission could therefore submit content they were not authorized to author and generate a shareable Live Preview URL rendering it.

### Patches

This has been fixed in 5.74.0 and 6.20.3.

## Affected packages

- `statamic/cms < 5.74.0`
- `statamic/cms >= 6.0.0, < 6.20.3`

## Remediation

Upgrade to a patched release:

- `statamic/cms 5.74.0`
- `statamic/cms 6.20.3`