5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32612

CVE-2026-32612: Statamic: privilege escalation via stored cross-site scripting

Statamic is a Laravel and Git powered content management system (CMS). Prior to 6.6.2, stored XSS in the control panel color mode preference allows authenticated users with control panel access to inject malicious JavaScript that executes when a higher-privileged user impersonates their account. This has been fixed in 6.6.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32612

CVE-2026-32612:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
statamic/cms	composer	>= 6.0.0, < 6.6.2	6.6.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is a stored Cross-Site Scripting (XSS) issue in the 'color mode' preference of Statamic CMS. The advisory states this is fixed in version 6.6.2. By comparing the git tags for versions 6.6.1 and 6.6.2, I identified the relevant commit that patches the vulnerability. The commit 8f1ea9ff8000de090c7406a80bb5aa273eda4e0f, titled '[6.x] Fix color mode preference values', directly addresses the issue. The patch modifies the preferredColorMode function within the src/Auth/User.php file. Previously, the function returned the user's preference value directly. The fix introduces a check to ensure the value is one of the expected safe values ('auto', 'light', 'dark'), otherwise defaulting to 'auto'. This change clearly indicates that the preferredColorMode function was the source of the vulnerability, as it was responsible for processing and returning the potentially malicious input without proper sanitization.

Vulnerable functions

Statamic\Auth\User::preferredColorMode

src/Auth/User.php

The `preferredColorMode` function in the `User` class was vulnerable to stored XSS. It directly retrieved and returned the 'color_mode' preference from the user's settings without any validation or sanitization. This allowed an authenticated attacker to save a malicious JavaScript payload as their color mode preference. When another user, such as an administrator, impersonated the attacker's account, the malicious script would be executed in the victim's browser, leading to privilege escalation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.