8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27939

CVE-2026-27939: Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass

Statmatic is a Laravel and Git powered content management system (CMS). Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel users may under certain conditions obtain elevated privileges without completing the intended verification step. This can allow access to sensitive operations and, depending on the user’s existing permissions, may lead to privilege escalation. This has been fixed in 6.4.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27939

CVE-2026-27939:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
statamic/cms	composer	>= 6.0.0, < 6.4.0	6.4.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, described as an 'elevated session bypass', stems from several open redirect flaws within the Statamic CMS control panel. The primary and most critical flaw exists in the getAuthExceptionRedirectUrl method, located in the RendersControlPanelExceptions trait. This method is invoked when an AuthorizationException is thrown, a common occurrence when a user attempts to access a resource requiring higher privileges or an 'elevated session' without proper authorization. The vulnerable version of the code would redirect the user to the URL specified in the Referer header without checking if it was an external site. An attacker could exploit this by tricking a logged-in user into clicking a specially crafted link. This link would point to a protected area of the control panel but include a Referer header pointing to an attacker-controlled domain. The resulting redirect could be used to bypass the password confirmation step required for elevating the user's session, thus leading to privilege escalation.

The same security patch also addresses two other open redirect vulnerabilities in the FormController. The formSuccess and formFailure methods were found to blindly trust the _redirect and _error_redirect parameters in form submissions, respectively. These could be used to redirect users to malicious sites after or during form submission. While these are significant vulnerabilities in their own right, the 'elevated session bypass' aspect is most directly associated with the flaw in the exception handling logic.

Vulnerable functions

Statamic\Exceptions\Concerns\RendersControlPanelExceptions->getAuthExceptionRedirectUrl

src/Exceptions/Concerns/RendersControlPanelExceptions.php

The function `getAuthExceptionRedirectUrl` within the `RendersControlPanelExceptions` trait is vulnerable to an open redirect. It uses the `Referer` header for redirection when an `AuthorizationException` occurs, without validating if the URL is external. This is the core of the privilege escalation vulnerability, as it allows an attacker to manipulate the redirect flow during authorization checks, such as the one for 'elevated sessions', potentially bypassing the password verification step.

Statamic\Http\Controllers\FormController->formFailure

src/Http/Controllers/FormController.php

The `formFailure` method in `FormController` is vulnerable to an open redirect. It processes form submissions that have failed and uses the `_error_redirect` parameter from the request to determine the redirect URL. Before the patch, this URL was not validated, allowing an attacker to craft a form that redirects users to a malicious external website upon a validation error.

Statamic\Http\Controllers\FormController->formSuccess

src/Http/Controllers/FormController.php

The `formSuccess` method in `FormController` is vulnerable to an open redirect. It handles successful form submissions and uses the `_redirect` parameter from the request for redirection. The lack of validation on this parameter allows an attacker to redirect users to an arbitrary external website after they successfully submit a form.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.