MEDIUM 6.5
GHSA-qh8c-7588-qfrv
Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries
Quick fix
GHSA-qh8c-7588-qfrv — statamic/cms: upgrade to the fixed version with the command below.
composer require statamic/cms:^5.74.1Details
### Impact
An authenticated Control Panel user could view content from entries they don't have permission to view, including entry content and custom field values, from any collection and including unpublished entries. No data could be modified.
### Patches
This has been fixed in 5.74.1 and 6.24.0.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist / statamic/cms
Introduced in:
0 Fixed in: 5.74.1 Fix
composer require statamic/cms:^5.74.1 Packagist / statamic/cms
Introduced in:
6.0.0 Fixed in: 6.24.0 Fix
composer require statamic/cms:^6.24.0 References
- https://github.com/statamic/cms/security/advisories/GHSA-qh8c-7588-qfrv [WEB]
- https://github.com/statamic/cms/pull/14906 [WEB]
- https://github.com/statamic/cms/commit/6557f1d8a0d61c0e7ad9c9a8f42cb3288607495d [WEB]
- https://github.com/statamic/cms [PACKAGE]
- https://github.com/statamic/cms/releases/tag/v5.74.1 [WEB]
- https://github.com/statamic/cms/releases/tag/v6.24.0 [WEB]