CVE-2026-27939

Statmatic is a Laravel and Git powered content management system (CMS). Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel users may under certain conditions obtain elevated privileges without completing the intended verification step. This can allow access to sensitive operations and, depending on the user’s existing permissions, may lead to privilege escalation. This has been fixed in 6.4.0.

• CWE-287

• https://github.com/statamic/cms/commit/8639ef96217eaa682bc42e8a62769cb7c6a85d3aPatch
• https://github.com/statamic/cms/security/advisories/GHSA-rw9x-pxqx-q789Vendor Advisory

Published

Feb 27, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27933Manyfold is an open source, self-hosted web application for …6.8
• CVE-2026-27934Discourse is an open-source discussion platform. Versions pr…7.5
• CVE-2026-27935Discourse is an open-source discussion platform. Versions pr…6.5
• CVE-2026-27936Discourse is an open-source discussion platform. Prior to ve…5.3
• CVE-2026-27937October is a Content Management System (CMS) and web platfor…3.1
• CVE-2026-27938WPGraphQL provides a GraphQL API for WordPress sites. Prior …7.7
• CVE-2026-2794Information disclosure due to uninitialized memory in Firefo…7.5
• CVE-2026-27940llama.cpp is an inference of several LLM models in C/C++. Pr…7.8
• CVE-2026-27941OpenLIT is an open source platform for AI engineering. Prior…9.9
• CVE-2026-27942fast-xml-parser allows users to validate XML, parse XML to J…7.5
• CVE-2026-27943OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-27944Nginx UI is a web user interface for the Nginx web server. P…9.8