CVE-2026-33887

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, authenticated Control Panel users could view entry revisions for any collection with revisions enabled, regardless of whether they had the required collection permissions. This bypasses the authorization checks that the main entry controllers enforce, exposing entry field values and blueprint data. Users could also create entry revisions without edit permission, though this only snapshots the existing content state and does not affect published content. This has been fixed in 5.73.16 and 6.7.2.

• CWE-862

• https://github.com/statamic/cms/security/advisories/GHSA-4hp7-3wxg-cv9qVendor Advisory

Published

Mar 27, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33881Windmill is an open-source developer platform for internal c…7.2
• CVE-2026-33882Statamic is a Laravel and Git powered content management sys…6.5
• CVE-2026-33883Statamic is a Laravel and Git powered content management sys…6.1
• CVE-2026-33884Statamic is a Laravel and Git powered content management sys…4.3
• CVE-2026-33885Statamic is a Laravel and Git powered content management sys…6.1
• CVE-2026-33886Statamic is a Laravel and Git powered content management sys…6.5
• CVE-2026-33888ApostropheCMS is an open-source Node.js content management s…5.3
• CVE-2026-33889ApostropheCMS is an open-source Node.js content management s…5.4
• CVE-2026-3389A vulnerability was determined in Squirrel up to 3.2. This v…5.5
• CVE-2026-33890MyTube is a self-hosted downloader and player for several vi…9.8
• CVE-2026-33891Forge (also called `node-forge`) is a native implementation …7.5
• CVE-2026-33892A vulnerability has been identified in Industrial Edge Manag…7.1