CVE-2026-27939CWE-287

Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass

High · published February 27, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
39.7
In the wild
Unconfirmed
What it is

Statmatic is a Laravel and Git powered content management system (CMS). Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel users may under certain conditions obtain elevated privileges without completing the intended verification step. This can allow access to sensitive operations and, depending on the user’s existing permissions, may lead to privilege escalation. This has been fixed in 6.4.0.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00470 · 39.7th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-02-27T21:34Z
EPSS history
Timeline
  • 27 FEB 21:34Z
    Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass
    cvelistv5