What is GHSA-7f74-7q5w-hj4r?

GHSA-7f74-7q5w-hj4r is a security advisory published by GitHub Security Advisories with Medium severity. Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential

Which CVE IDs does GHSA-7f74-7q5w-hj4r cover?

GHSA-7f74-7q5w-hj4r covers the following CVE IDs: CVE-2026-33885. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7f74-7q5w-hj4r?

GHSA-7f74-7q5w-hj4r has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-7f74-7q5w-hj4r?

GHSA-7f74-7q5w-hj4r affects 2 products, including: composer/statamic/cms:\u003c 5.73.16; composer/statamic/cms:\u003e= 6.0.0.alpha.1, \u003c 6.7.2.

GHSA-7f74-7q5w-hj4rMediumCVSS 6.1

Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential

Vendor

GitHub Security Advisories

Published

March 26, 2026

Last Modified

March 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-33885 →

📋 Description

Impact

The external URL detection used for redirect validation on unauthenticated endpoints could be bypassed, allowing users to be redirected to external URLs after actions like form submissions and authentication flows.

Patches

This has been fixed in 5.73.16 and 6.7.2.

🎯 Affected products2

composer/statamic/cms:< 5.73.16
composer/statamic/cms:>= 6.0.0.alpha.1, < 6.7.2

🔗 References (3)

https://github.com/statamic/cms/security/advisories/GHSA-7f74-7q5w-hj4r
https://nvd.nist.gov/vuln/detail/CVE-2026-33885
https://github.com/advisories/GHSA-7f74-7q5w-hj4r