GHSA-rw9x-pxqx-q789

Source

https://github.com/advisories/GHSA-rw9x-pxqx-q789

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-rw9x-pxqx-q789/GHSA-rw9x-pxqx-q789.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rw9x-pxqx-q789

Aliases

CVE-2026-27939

Published

2026-02-27T21:35:00Z

Modified

2026-03-04T15:06:33.729954Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass

Details

Impact

Authenticated Control Panel users may under certain conditions obtain elevated privileges without completing the intended verification step. This can allow access to sensitive operations and, depending on the user’s existing permissions, may lead to privilege escalation.

Patches

This has been fixed in 6.4.0.

Database specific

{
    "nvd_published_at": "2026-02-27T22:16:22Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-27T21:35:00Z",
    "cwe_ids": [
        "CWE-287"
    ]
}

References

Affected packages

Packagist / statamic/cms

Package

Name: statamic/cms
Purl: pkg:composer/statamic/cms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.0.0

Fixed

6.4.0

Affected versions

v6.*

v6.0.0

v6.1.0

v6.2.0

v6.2.1

v6.2.2

v6.2.3

v6.2.4

v6.2.5

v6.3.0

v6.3.1

v6.3.2

v6.3.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-rw9x-pxqx-q789/GHSA-rw9x-pxqx-q789.json"