CVE-2026-49288
Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources
4.3
MEDIUM
CVSS 3.1
EPSS 0.16%
Description
### Impact An authenticated Control Panel user could view metadata and content for resources they don't have permission to view, including entries, assets, users, roles, groups, and other configured resources. Depending on the resource, this could expose titles, custom field values, entry content, asset metadata, and the existence of users, roles, and groups. No data could be modified. ### Patches This has been fixed in 5.73.23 and 6.20.0.
How to fix CVE-2026-49288
To remediate CVE-2026-49288, upgrade the affected package to a fixed version below.
- —upgrade to 5.73.23 or later
Is CVE-2026-49288 being exploited?
Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 5.73.23
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |