CVE-2026-64662

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from entries they did not have permission to view, including entry content and custom field values, from any collection and including unpublished...

Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries

Impact An authenticated Control Panel user could view content from entries they don't have permission to view, including entry content and custom field values, from any collection and including unpublished entries. No data could be modified. Patches This has been fixed in 5.74.1 and 6.24.0...

CVE-2026-64662 Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from entries they did not have permission to view, including entry content and custom field values, from any collection and including unpublished...

CVE-2026-64662

Summary of CVE-2026-64662 (Statamic) : Statamic, a Laravel and Git powered CMS, had an issue where an authenticated Control Panel user could view content from entries they were not permitted to view, including entry content and custom field values, across any collection and including unpublished ...

CVE-2026-64662 Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from entries they did not have permission to view, including entry content and custom field values, from any collection and including unpublished...

Information Disclosure

phpMyFAQ is vulnerable to Information Disclosure. The vulnerability is due to inconsistent access control on public FAQ API endpoints, where inactive or unpublished FAQ entries are returned without proper status validation, allowing unauthenticated attackers to access non-public FAQ content...