4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33177

CVE-2026-33177: Statamic is missing authorization check on taxonomy term creation via fieldtype

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action processing endpoint with attacker-controlled field definitions. This bypasses the authorization checks enforced on the standard taxonomy term creation endpoint. This has been fixed in 5.73.14 and 6.7.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33177

CVE-2026-33177:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
statamic/cms	composer	>= 6.0.0-alpha.1, < 6.7.0	6.7.0
statamic/cms	composer	< 5.73.14	5.73.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows low-privileged users to create taxonomy terms without proper authorization. The root cause is a missing permission check in the createTermFromString method within the Statamic\Fieldtypes\Terms class, located in src/Fieldtypes/Terms.php. The security advisory points to patches that fix this issue, and by analyzing the associated pull request commits, the exact vulnerable code was identified.

The process method within the same class acts as the entry point for the malicious request. It takes user-supplied data from the control panel's field action endpoint and passes it to createTermFromString. Before the patch, createTermFromString would proceed to create a new term without verifying the user's permissions.

The patch introduces an authorization check using User::current()->cant('create', ...) inside createTermFromString. If the user lacks permission, the function now returns null instead of creating the term. The process method was also updated to filter out these null values, preventing unauthorized term creation. Both process and createTermFromString are therefore key functions that would appear in a runtime profile during exploitation.

Vulnerable functions

Statamic\Fieldtypes\Terms->createTermFromString

src/Fieldtypes/Terms.php

This function is responsible for creating a new taxonomy term from a given string. Prior to the patch, it did not perform any authorization checks, allowing any authenticated user to create terms, even if they lacked the necessary permissions. The patch adds a check to ensure the user is authorized to create terms for the specified taxonomy.

Statamic\Fieldtypes\Terms->process

src/Fieldtypes/Terms.php

This function processes the data submitted from the frontend for the terms fieldtype. It iterates through the submitted values and calls `createTermFromString` for any new terms. This function serves as the entry point for the user-controlled data that triggers the vulnerability in `createTermFromString`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.