CVE-2026-41175

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.20 and 6.13.0, manipulating query parameters on Control Panel and REST API endpoints, or arguments in GraphQL queries, could result in the loss of content, assets, and user accounts. The Control Panel requires authentication with minimal permissions in order to exploit. e.g. "view entries" permission to delete entries, or "view users" permission to delete users, etc. The REST and GraphQL API exploits do not require any permissions, however neither are enabled by default. In order to be exploited, they would need to be explicitly enabled with no authentication configured, and the specific resources enabled too. Sites that enable the REST or GraphQL API without authentication should treat patching as critical priority. This has been fixed in 5.73.20 and 6.13.0.

• CWE-470

• https://github.com/statamic/cms/security/advisories/GHSA-4jjr-vmv7-wh4wVendor Advisory

Published

Apr 22, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4117The CalJ plugin for WordPress is vulnerable to Missing Autho…5.3
• CVE-2026-41170Squidex is an open source headless content management system…7.2
• CVE-2026-41171Squidex is an open source headless content management system…7.3
• CVE-2026-41172Squidex is an open source headless content management system…7.3
• CVE-2026-41173The AWS X-Ray Remote Sampler package provides a sampler whic…5.9
• CVE-2026-41174Traefik is an HTTP reverse proxy and load balancer. Prior to…6.4
• CVE-2026-41176Rclone is a command-line program to sync files and directori…9.8
• CVE-2026-41177Squidex is an open source headless content management system…5.5
• CVE-2026-41178OpenTelemetry-Go is the Go implementation of OpenTelemetry. …5.3
• CVE-2026-41179Rclone is a command-line program to sync files and directori…9.8
• CVE-2026-4118The Call To Action Plugin plugin for WordPress is vulnerable…4.3
• CVE-2026-41180PsiTransfer is an open source, self-hosted file sharing solu…7.5