GHSA-5m64-9hq5-5pf2HighCVSS 8.8

Statamic framework Incorrect Permission Assignment

Published
May 13, 2022
Last Modified
October 10, 2023

🔗 CVE IDs covered (1)

📋 Description

Statamic framework before 2.6.0 does not correctly check a session's permissions when the methods from a user's class are called. Problematic methods include reset password, create new account, create new role, etc.

🎯 Affected products1

  • composer/statamic/cms:< 2.6.0

🔗 References (2)