LOW 3.5
GHSA-7mqq-4v55-88gh
Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors
Details
### Impact
The Live Preview endpoint for existing entries and terms only checked view authorization, but it accepts and renders caller-supplied field values. A Control Panel user with view but not edit permission could therefore submit content they were not authorized to author and generate a shareable Live Preview URL rendering it.
### Patches
This has been fixed in 5.74.0 and 6.20.3.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist / statamic/cms
Introduced in:
0 Fixed in: 5.74.0 Fix
composer require statamic/cms:^5.74.0 Packagist / statamic/cms
Introduced in:
6.0.0 Fixed in: 6.20.3 Fix
composer require statamic/cms:^6.20.3