CVE-2026-27196 is a Stored Cross-Site Scripting (XSS) vulnerability classified under CWE-79, affecting Statamic CMS, a Laravel and Git-powered content management system. The vulnerability resides in the html fieldtypes component, which improperly neutralizes input during web page generation. Authenticated users with field management permissions can inject malicious JavaScript code into these fields. When higher-privileged users view the compromised content, the injected script executes in their browsers, potentially allowing attackers to hijack sessions, steal sensitive data, or perform actions with elevated privileges. The vulnerability affects Statamic versions 5.73.8 and below, and 6.0.0-alpha.1 through 6.3.1. It has been remediated in versions 5.73.9 and 6.3.2. The CVSS v3.1 base score is 8.1, reflecting high severity due to network attack vector, low attack complexity, requirement of high privileges, and user interaction. The scope is changed as the attack can impact higher-privileged users beyond the initial attacker. No public exploits have been reported yet, but the vulnerability poses a significant risk in environments where multiple privilege levels exist and field management permissions are granted.

The impact of CVE-2026-27196 is significant for organizations using affected Statamic CMS versions. Successful exploitation allows an attacker with field management permissions to execute arbitrary JavaScript in the context of higher-privileged users, potentially leading to session hijacking, credential theft, unauthorized actions, and data exfiltration. This undermines the confidentiality and integrity of the CMS and its managed content. Since the attack requires authentication but low complexity, insider threats or compromised lower-privileged accounts could escalate their influence. The vulnerability does not directly affect availability but can facilitate further attacks that might. Organizations relying on Statamic CMS for content management, especially those with complex user roles and sensitive data, face increased risk of privilege escalation and data breaches if unpatched.

To mitigate CVE-2026-27196, organizations should immediately upgrade Statamic CMS to versions 5.73.9 or 6.3.2 or later, where the vulnerability is patched. Additionally, review and restrict field management permissions to only trusted users to reduce the attack surface. Implement Content Security Policy (CSP) headers to limit the impact of injected scripts. Conduct regular audits of CMS content fields for suspicious or unauthorized scripts. Employ web application firewalls (WAFs) with rules targeting XSS payloads in CMS inputs. Educate administrators and users about the risks of XSS and the importance of cautious content management. Finally, monitor logs for unusual activities related to field modifications and user privilege escalations.