CVE-2026-33887 is a missing authorization vulnerability in Statamic CMS affecting versions before 5.73.16 and between 6.0.0-alpha.1 and 6.7.2. Authenticated Control Panel users could bypass collection permission checks to view entry revisions and associated field values and blueprint data for any collection with revisions enabled. They could also create entry revisions without edit permissions, but this does not impact published content. The issue arises because authorization checks enforced by main entry controllers are bypassed for entry revisions. The vulnerability has been fixed in Statamic versions 5.73.16 and 6.7.2.

An authenticated user with Control Panel access but without specific collection permissions can view sensitive entry revision data, potentially exposing confidential content fields and blueprint configurations. They can also create entry revisions without edit rights, though this does not affect live published content. The confidentiality and integrity of entry revisions are impacted, but availability is not affected. The CVSS score of 5.4 reflects a medium severity level with network attack vector, low attack complexity, and requiring privileges but no user interaction.

Upgrade Statamic CMS to version 5.73.16 or later, or 6.7.2 or later, where this authorization bypass vulnerability has been fixed. No other mitigations are indicated or necessary once patched. Patch status is confirmed by the vendor advisory embedded in the description.