CVE-2026-33177CWE-862

Statamic is missing authorization check on taxonomy term creation via fieldtype

Medium · published March 20, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
19.1
In the wild
Unconfirmed
What it is

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action processing endpoint with attacker-controlled field definitions. This bypasses the authorization checks enforced on the standard taxonomy term creation endpoint. This has been fixed in 5.73.14 and 6.7.0.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00277 · 19.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-03-20T21:41Z
EPSS history
Timeline
  • 20 MAR 21:41Z
    Statamic is missing authorization check on taxonomy term creation via fieldtype
    cvelistv5