CVE-2026-54244: Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors ### Impact The Live Preview endpoint for existing…

low

Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors

### Impact

The Live Preview endpoint for existing entries and terms only checked view authorization, but it accepts and renders caller-supplied field values. A Control Panel user with view but not edit permission could therefore submit content they were not authorized to author and generate a shareable Live Preview URL rendering it.

### Patches

This has been fixed in 5.74.0 and 6.20.3.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
statamic	cms	>= 0 < 5.74.0	5.74.0
statamic	cms	>= 6.0.0 < 6.20.3	6.20.3

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.