What is GHSA-rw9x-pxqx-q789?

GHSA-rw9x-pxqx-q789 is a security advisory published by GitHub Security Advisories with High severity. Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass

Which CVE IDs does GHSA-rw9x-pxqx-q789 cover?

GHSA-rw9x-pxqx-q789 covers the following CVE IDs: CVE-2026-27939. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rw9x-pxqx-q789?

GHSA-rw9x-pxqx-q789 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-rw9x-pxqx-q789?

GHSA-rw9x-pxqx-q789 affects 1 product, including: composer/statamic/cms:\u003e= 6.0.0, \u003c 6.4.0.

GHSA-rw9x-pxqx-q789HighCVSS 8.8

Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass

Vendor

GitHub Security Advisories

Published

February 27, 2026

Last Modified

March 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-27939 →

📋 Description

Impact

Authenticated Control Panel users may under certain conditions obtain elevated privileges without completing the intended verification step. This can allow access to sensitive operations and, depending on the user’s existing permissions, may lead to privilege escalation.

Patches

This has been fixed in 6.4.0.

🎯 Affected products1

composer/statamic/cms:>= 6.0.0, < 6.4.0

🔗 References (4)

https://github.com/statamic/cms/security/advisories/GHSA-rw9x-pxqx-q789
https://github.com/statamic/cms/commit/8639ef96217eaa682bc42e8a62769cb7c6a85d3a
https://nvd.nist.gov/vuln/detail/CVE-2026-27939
https://github.com/advisories/GHSA-rw9x-pxqx-q789