CVE-2026-25633CWE-862

Statamic's missing authorization allows access to assets

Medium · published February 11, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
36.5
In the wild
Unconfirmed
What it is

Statamic is a, Laravel + Git powered CMS designed for building websites. Prior to 5.73.6 and 6.2.5, users without permission to view assets are able are able to download them and view their metadata. Logged-out users and users without permission to access the control panel are unable to take advantage of this. This has been fixed in 5.73.6 and 6.2.5.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00432 · 36.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-02-11T20:33Z
EPSS history
Timeline
  • 11 FEB 20:33Z
    Statamic's missing authorization allows access to assets
    cvelistv5