LOW3.5
GHSA-7mqq-4v55-88gh
Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors
Quick fix
GHSA-7mqq-4v55-88gh — statamic/cms: upgrade to the fixed version with the command below.
composer require statamic/cms:^5.74.0Details
### Impact
The Live Preview endpoint for existing entries and terms only checked view authorization, but it accepts and renders caller-supplied field values. A Control Panel user with view but not edit permission could therefore submit content they were not authorized to author and generate a shareable Live Preview URL rendering it.
### Patches
This has been fixed in 5.74.0 and 6.20.3.
Are you affected?
Enter the version of the package you're using.