Most recent entries from all

EUVD-2026-276994

fkie_cve-2026-33177

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action processing endpoint with attacker-controlled field definitions. This bypasses the authorization checks enforced on the standard taxonomy term creation endpoint. This has been fixed in 5.73.14 and 6.7.0.

GHSA-wh3h-gvc4-cc2g — Statamic is missing authorization check on taxonomy term creation via fieldtype

Affected: Packagist: statamic/cms

### Impact

Low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action processing endpoint with attacker-controlled field definitions. This bypasses the authorization checks enforced on the standard taxonomy term creation endpoint.

### Patches

This has been fixed in 5.73.14 and 6.7.0.