Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Statmatic is a Laravel and Git powered content management system (CMS). Versions 5.73.8 and below in addition to 6.0.0-alpha.1 through 6.3.1 have a Stored XSS vulnerability in html fieldtypes which allows authenticated users with field management permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This issue has been fixed in 6.3.2 and 5.73.9.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
A privilege escalation flaw via stored XSS affects `Statamic CMS` (CVE-2026-27196). This could allow authenticated users to gain elevated privileges. #Statamic #XSS #infosec https://www.pulsepatch.io/posts/cve-2026-27196-statamic-cms-privilege-escalation-xss
Post summary
The post announces a stored XSS vulnerability (CVE-2026-27196) in Statamic CMS that allows authenticated users to gain elevated privileges.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | statamic | statamic | - | - | - |