CVE-2026-41175 - Vulnerability Analysis

Overview

Statamic < 5.73.20 and < 6.13.0 contain an authorization bypass caused by improper permission checks on Control Panel, REST API, and GraphQL endpoints, letting attackers delete content, assets, and user accounts, exploit requires minimal permissions or no authentication if APIs are enabled.

Severity & Score

Impact

Attackers can delete content, assets, and user accounts, causing data loss and disruption.

Mitigation

Update to versions 5.73.20 or 6.13.0 or later.

References

• https://github.com/statamic/cms/security/advisories/GHSA-4jjr-vmv7-wh4w

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner