CVE-2026-33177
published 2026-03-20CVE-2026-33177: Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, low-privileged Control Panel users could create…
PriorityP423medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.22%
12.9th percentile
Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action processing endpoint with attacker-controlled field definitions. This bypasses the authorization checks enforced on the standard taxonomy term creation endpoint. This has been fixed in 5.73.14 and 6.7.0.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| statamic | cms | < 5.73.14 | 5.73.14 |
| statamic | cms | — | — |
| statamic | cms | >= 0 < 5.73.14 | 5.73.14 |
| statamic | cms | >= 6.0.0-alpha.1 < 6.7.0 | 6.7.0 |
| statamic | statamic | < 5.73.14 | 5.73.14 |
| statamic | statamic | >= 6.0.0 < 6.7.0 | 6.7.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Statamic is missing authorization check on taxonomy term creation via fieldtype
ghsa·2026-03-18
CVE-2026-33177 [MEDIUM] CWE-862 Statamic is missing authorization check on taxonomy term creation via fieldtype
Statamic is missing authorization check on taxonomy term creation via fieldtype
### Impact
Low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action processing endpoint with attacker-controlled field definitions. This bypasses the authorization checks enforced on the standard taxonomy term creation endpoint.
### Patches
This has been fixed in 5.73.14 and 6.7.0.
OSV
Statamic is missing authorization check on taxonomy term creation via fieldtype
osv·2026-03-18
CVE-2026-33177 [MEDIUM] Statamic is missing authorization check on taxonomy term creation via fieldtype
Statamic is missing authorization check on taxonomy term creation via fieldtype
### Impact
Low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action processing endpoint with attacker-controlled field definitions. This bypasses the authorization checks enforced on the standard taxonomy term creation endpoint.
### Patches
This has been fixed in 5.73.14 and 6.7.0.
No detection rules found.
No public exploits indexed.
2026-03-20
Published