VulnSocial

CVE-2026-49288Disclosure

LOWCVSS 4.3 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Control Panel user could view metadata and content for resources they don't have permission to view, including entries, assets, users, roles, groups, and other configured resources. Depending on the resource, this could expose titles, custom field values, entry content, asset metadata, and the existence of users, roles, and groups. No data could be modified. This has been fixed in 5.73.23 and 6.20.0.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-200CWE-862CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-06-20: 2Patch / Workaround · 2026-06-20: 1Technical Details · 2026-06-20: 206-20
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-49288 Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Control Panel user could view metadata and conten… https://www.cve.org/CVERecord?id=CVE-2026-49288 ----- Traducción: CVE-2026-49288 Sta… http://infoflow.cloud`

    Post summary

    The post announces CVE-2026‑49288 affecting Statamic, noting that authentication lets Control Panel users access metadata prior to version 5.73.23/6.20.0, but no PoC, exploit, or active use is reported.

    0000032
    88 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-49288 Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Control Panel user could view metadata and conten… https://www.cve.org/CVERecord?id=CVE-2026-49288

    Post summary

    The entry discloses that CVE-2026-49288 is an information‑disclosure flaw in Statamic CMS, allowing authenticated Control Panel users to view metadata and content in versions earlier than 5.73.23 and 6.20.0, with no PoC, exploit, or patch mentioned.

    00000242
    57.7K followersView on X

Explore more

Back to dashboard