Statamic CMS versions before 5.73.20 and 6.13.0 contain an unsafe reflection vulnerability (CWE-470) that can be exploited by manipulating query parameters in Control Panel, REST API, or GraphQL endpoints. The Control Panel attack vector requires authenticated users with minimal permissions such as 'view entries' or 'view users' to delete respective resources. The REST and GraphQL API vectors do not require authentication but these APIs are disabled by default and must be explicitly enabled without authentication for exploitation. Successful exploitation can lead to deletion of content, assets, and user accounts. The vulnerability has been addressed in Statamic versions 5.73.20 and 6.13.0.

Exploitation can result in unauthorized deletion of content, assets, and user accounts within the Statamic CMS. Control Panel exploitation requires minimal authenticated permissions, while REST and GraphQL API exploitation requires these APIs to be enabled without authentication. This can cause significant data loss and disruption of CMS operations.

Upgrade Statamic CMS to version 5.73.20 or later, or 6.13.0 or later, where this vulnerability is fixed. Sites that enable the REST or GraphQL APIs without authentication should prioritize patching immediately. If REST or GraphQL APIs are not enabled or are properly secured with authentication, the risk is significantly reduced. No other specific mitigations are indicated.