CVE-2026-72778

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig, but...

EUVD-2026-56102

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig, but...

CVE-2026-72778 Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig, but...

CVE-2026-72778 Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig, but...

CVE-2026-72778 Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig, but...

CVE-2026-72778

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig, but...

CVE-2026-72778

Summary: CVE-2026-72778 affects Craft CMS 4.x (from 4.0.0-RC1 up to 4.18.2) and 5.x (from 5.0.0-RC1 up to 5.10.6). The vulnerability is an authenticated remote code execution in the control panel element-search condition handling. The root cause is that Condition::createCondition() decodes and me...

PT-2026-70178

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig, but...

CVE-2026-64662

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from entries they did not have permission to view, including entry content and custom field values, from any collection and including unpublished...

Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

ChartsController::actionGetNewUsersData at /actions/charts/get-new-users-data is missing a requirePermission'viewUsers' authorization check. Any authenticated control panel user, regardless of permissions beyond accessCp, can POST to this endpoint to receive time-series user registration counts f...

GHSA-RVMM-V933-JGXQ Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

ChartsController::actionGetNewUsersData at /actions/charts/get-new-users-data is missing a requirePermission'viewUsers' authorization check. Any authenticated control panel user, regardless of permissions beyond accessCp, can POST to this endpoint to receive time-series user registration counts f...

GHSA-2RP4-X2J7-QMCC Craft CMS: Stored XSS in the control panel via unescaped draft name

The control-panel helper that renders element chip/card labels writes an element's draftName into the page without HTML-encoding it, while the surrounding path segments are encoded. A low-privilege control-panel user who can create a draft of an element for example, an entry controls the draft...

Cross-site Scripting (XSS)

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the draftName field in the control panel rendering process. An attacker can execute arbitrary JavaScript in the session of higher-privileged users by crafting a...

Protection Mechanism Failure

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Protection Mechanism Failure through the SecurityPolicy process. An attacker can execute arbitrary code on the server by rendering a malicious Twig template after authenticating to the contro...

Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

Craft CMS has an authenticated remote code execution issue in the control panel element-search condition handling. Craft cleans the outer request-controlled condition array with Component::cleanseConfig, but Conditions::createCondition later decodes and merges the JSON string in condition.config...

GHSA-QH8C-7588-QFRV Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries

Impact An authenticated Control Panel user could view content from entries they don't have permission to view, including entry content and custom field values, from any collection and including unpublished entries. No data could be modified. Patches This has been fixed in 5.74.1 and 6.24.0...

Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries

Impact An authenticated Control Panel user could view content from entries they don't have permission to view, including entry content and custom field values, from any collection and including unpublished entries. No data could be modified. Patches This has been fixed in 5.74.1 and 6.24.0...

CVE-2026-64662 Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from entries they did not have permission to view, including entry content and custom field values, from any collection and including unpublished...

GHSA-225X-3JHX-WH4Q Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence

Impact An authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belongs to an existing user, without having permission to view users. The endpoint only exposed user existence, not any of its data. Patches This has been...

Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence

Impact An authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belongs to an existing user, without having permission to view users. The endpoint only exposed user existence, not any of its data. Patches This has been...