Skip to content
OpenAdvisories
Medium · 4.3 CVE-2026-33177 EUVD-2026-13827GHSA-wh3h-gvc4-cc2g

Statamic is missing authorization check on taxonomy term creation via fieldtype

Published Mar 20, 2026 · Updated Mar 23, 2026 · Assigned by GitHub_M

Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action processing endpoint with attacker-controlled field definitions. This bypasses the authorization checks enforced on the standard taxonomy term creation endpoint. This has been fixed in 5.73.14 and 6.7.0.

Affected products

VendorProductAffectedFixed
statamic cms >= 6.0.0-alpha.1, < 6.7.0, < 5.73.14 —

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist statamic/cms >= 6.0.0-alpha.1, < 6.7.0 6.7.0 GHSA-wh3h-gvc4-cc2g
Packagist statamic/cms < 5.73.14 5.73.14 GHSA-wh3h-gvc4-cc2g

References