CVE-2026-27939
published 2026-02-27CVE-2026-27939: Statmatic is a Laravel and Git powered content management system (CMS). Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel users…
PriorityP355high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.39%
30.4th percentile
Statmatic is a Laravel and Git powered content management system (CMS). Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel users may under certain conditions obtain elevated privileges without completing the intended verification step. This can allow access to sensitive operations and, depending on the user’s existing permissions, may lead to privilege escalation. This has been fixed in 6.4.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| statamic | cms | — | — |
| statamic | cms | >= 6.0.0 < 6.4.0 | 6.4.0 |
| statamic | statamic | >= 6.0.0 < 6.4.0 | 6.4.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass
osv·2026-02-27
CVE-2026-27939 [HIGH] Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass
Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass
## Impact
Authenticated Control Panel users may under certain conditions obtain elevated privileges without completing the intended verification step. This can allow access to sensitive operations and, depending on the user’s existing permissions, may lead to privilege escalation.
## Patches
This has been fixed in 6.4.0.
GHSA
Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass
ghsa·2026-02-27
CVE-2026-27939 [HIGH] CWE-287 Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass
Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass
## Impact
Authenticated Control Panel users may under certain conditions obtain elevated privileges without completing the intended verification step. This can allow access to sensitive operations and, depending on the user’s existing permissions, may lead to privilege escalation.
## Patches
This has been fixed in 6.4.0.
No detection rules found.
No public exploits indexed.
2026-02-27
Published