4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25633

CVE-2026-25633: Statamic's missing authorization allows access to assets

Statamic is a, Laravel + Git powered CMS designed for building websites. Prior to 5.73.6 and 6.2.5, users without permission to view assets are able are able to download them and view their metadata. Logged-out users and users without permission to access the control panel are unable to take advantage of this. This has been fixed in 5.73.6 and 6.2.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25633

CVE-2026-25633:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
statamic/cms	composer	< 5.73.6	5.73.6
statamic/cms	composer	>= 6.0.0-alpha.1, < 6.2.5	6.2.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in several controllers within the Statamic CMS's Control Panel (CP) that handle asset-related requests. The core issue is a 'Missing Authorization' (CWE-862) weakness. Authenticated users with access to the control panel, but without specific permissions to view certain assets, could still access them through different endpoints.

The analysis of the patch 5a6f47246edf3a0c453727ffecbfa14333a6bc8a reveals the following:

Direct Asset Access: The PdfController::show and SvgController::show methods directly served asset files without verifying if the user was authorized to view the specific asset. The patch adds a call to $this->authorize('view', $asset); to enforce this check.
Thumbnail Access: Similarly, the ThumbnailController::show method, which generates image thumbnails, lacked an authorization check. An attacker could view thumbnails of images they were not supposed to see. The patch adds the same authorization check here.
Folder Metadata Modification: The FoldersController::update method, along with its corresponding route, was completely removed. This indicates it provided a way to modify asset folder information without proper authorization checks.

By exploiting these missing checks, a low-privileged but authenticated user could download original assets or view their thumbnails and metadata, bypassing the intended permission model.

Vulnerable functions

FoldersController::update

src/Http/Controllers/CP/Assets/FoldersController.php

This function was removed as it allowed unauthorized users to update asset folders. The route pointing to this controller action was also removed in `routes/cp.php`.

PdfController::show

src/Http/Controllers/CP/Assets/PdfController.php

This function was missing an authorization check before returning the contents of a PDF asset, allowing users without 'view' permission to access it.

SvgController::show

src/Http/Controllers/CP/Assets/SvgController.php

This function was missing an authorization check before returning the contents of an SVG asset, allowing users without 'view' permission to access it.

ThumbnailController::show

src/Http/Controllers/CP/Assets/ThumbnailController.php

This function was missing an authorization check before generating and returning an asset thumbnail, allowing users without 'view' permission to access a representation of the asset.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.