CVE-2026-33885

MEDIUM

Statamic Unauthenticated Endpoints - Open Redirect

Title source: manual
STIX 2.1

Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the external URL detection used for redirect validation on unauthenticated endpoints could be bypassed, allowing users to be redirected to external URLs after actions like form submissions and authentication flows. This has been fixed in 5.73.16 and 6.7.2.

References (1)

Core 1
Core References

Scores

CVSS v3 6.1
EPSS 0.0018
EPSS Percentile 7.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-601
Status published
Products (4)
statamic/cms 0 - 5.73.16Packagist
statamic/cms < 5.73.16
statamic/cms >= 6.0.0.alpha.1, < 6.7.2
statamic/statamic < 5.73.16
Published Mar 27, 2026
Tracked Since Mar 29, 2026