cvedb.io
CVE-2026-27939
HIGH · CVSS 8.8
EPSS exploitation probability: 0%
Published 2026-02-27T22:16:22.993 · Last modified 2026-06-17T10:27:56.557

Summary

Statmatic is a Laravel and Git powered content management system (CMS). Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel users may under certain conditions obtain elevated privileges without completing the intended verification step. This can allow access to sensitive operations and, depending on the user’s existing permissions, may lead to privilege escalation. This has been fixed in 6.4.0.

Affected products

statamic — statamic

Does this affect you?

Add your gear to cvedb and we'll alert you only when statamic ships something exploited.

Check my exposure →

References

This product uses data from the NVD API but is not endorsed or certified by the NVD. Informational only; not professional security advice.