Access Control

Every one of the 7 is a mark on the map. Named now: 1 to 7, most at risk first.

1. Statamic framework before 2.6.0 does not correctly check a session's permissions when the methods from a user's class are called. Problematic methods include reset password, creat…CVE-2017-11422Statamic · 0.9% likely

   CWE-732

2. Statamic's missing authorization allows access to assetsCVE-2026-25633statamic · CVSS 4.3 · 0.3% likely

   CWE-862

3. Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editorsCVE-2026-54244statamic · CVSS 3.5 · 0.3% likely

   CWE-863

4. Statamic's missing authorization allows access to email addressesCVE-2026-28424statamic · CVSS 6.5 · 0.3% likely

   CWE-862

5. Statamic is missing authorization check on taxonomy term creation via fieldtypeCVE-2026-33177statamic · CVSS 4.3 · 0.2% likely

   CWE-862

6. Statamic's live preview token bypasses content protection for unrelated entriesCVE-2026-33884statamic · CVSS 4.3 · 0.2% likely

   CWE-863

7. Statamic allows unauthorized content access through missing authorization in its revision controllersCVE-2026-33887statamic · CVSS 5.4 · 0.2% likely

   CWE-862

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.