CVE-2026-33886: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in statamic cms
Statamic is a Laravel and Git powered content management system (CMS). Starting in version 5.7.12 and prior to versions 5.73.16 and 6.7.2, a control panel user with access to Antlers-enabled fields could access sensitive application configuration values by inserting config variables into their content. This has been fixed in 5.73.16 and 6.7.2.
AI Analysis
Technical Summary
Statamic CMS, a Laravel and Git-powered content management system, contained a vulnerability (CVE-2026-33886) in certain versions where control panel users with access to Antlers-enabled fields could retrieve sensitive application configuration data by embedding config variables in content fields. This exposure of sensitive information (CWE-200) could lead to unauthorized disclosure of configuration details. The vulnerability affects versions >= 5.73.12 and < 5.73.16, and >= 6.0.0.alpha.1 and < 6.7.2. The issue was resolved in versions 5.73.16 and 6.7.2.
Potential Impact
An attacker with control panel user privileges and access to Antlers-enabled fields can access sensitive application configuration values, potentially leading to information disclosure. The vulnerability does not allow integrity or availability impacts but poses a confidentiality risk. The CVSS score of 6.5 indicates a medium severity vulnerability with network attack vector and low attack complexity, requiring privileges but no user interaction.
Mitigation Recommendations
Upgrade Statamic CMS to version 5.73.16 or later, or version 6.7.2 or later, where this vulnerability has been fixed. No other mitigations are specified or required once the update is applied. Patch status is confirmed fixed in these versions.
CVE-2026-33886: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in statamic cms
Description
Statamic is a Laravel and Git powered content management system (CMS). Starting in version 5.7.12 and prior to versions 5.73.16 and 6.7.2, a control panel user with access to Antlers-enabled fields could access sensitive application configuration values by inserting config variables into their content. This has been fixed in 5.73.16 and 6.7.2.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Statamic CMS, a Laravel and Git-powered content management system, contained a vulnerability (CVE-2026-33886) in certain versions where control panel users with access to Antlers-enabled fields could retrieve sensitive application configuration data by embedding config variables in content fields. This exposure of sensitive information (CWE-200) could lead to unauthorized disclosure of configuration details. The vulnerability affects versions >= 5.73.12 and < 5.73.16, and >= 6.0.0.alpha.1 and < 6.7.2. The issue was resolved in versions 5.73.16 and 6.7.2.
Potential Impact
An attacker with control panel user privileges and access to Antlers-enabled fields can access sensitive application configuration values, potentially leading to information disclosure. The vulnerability does not allow integrity or availability impacts but poses a confidentiality risk. The CVSS score of 6.5 indicates a medium severity vulnerability with network attack vector and low attack complexity, requiring privileges but no user interaction.
Mitigation Recommendations
Upgrade Statamic CMS to version 5.73.16 or later, or version 6.7.2 or later, where this vulnerability has been fixed. No other mitigations are specified or required once the update is applied. Patch status is confirmed fixed in these versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-24T15:10:05.681Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 69c6efce3c064ed76ff462db
Added to database: 3/27/2026, 8:59:58 PM
Last enriched: 4/4/2026, 10:51:12 AM
Last updated: 5/11/2026, 6:33:27 AM
Views: 30
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.