CVE-2026-33887: 
PHP vulnerability analysis and mitigation

CVE-2026-33887 is a missing authorization vulnerability in Statamic CMS that allows authenticated Control Panel users to view entry revisions for any collection with revisions enabled, bypassing collection-level permission checks. It was published by the vendor on March 24, 2026, and added to the GitHub Advisory Database on March 26, 2026. Affected versions include all releases of statamic/cms before 5.73.16 and versions 6.0.0-alpha.1 through 6.7.2. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Statamic Advisory).

The root cause is CWE-862 (Missing Authorization): the revision controllers in Statamic CMS do not enforce the same collection-level permission checks that the main entry controllers apply. As a result, any authenticated Control Panel user can send requests to the revision endpoints for collections they lack access to, retrieving entry field values and blueprint data. Additionally, users without edit permissions can trigger revision creation, which snapshots the current content state — though this does not alter published content. No public proof-of-concept exploit code has been identified (GitHub Advisory, Statamic Advisory).

Exploitation allows low-privileged, authenticated Control Panel users to read entry field values and blueprint data from any collection with revisions enabled, regardless of their assigned permissions — resulting in unauthorized information disclosure. There is also a minor integrity impact, as such users can create revision snapshots without edit rights, though published content is not modified. Availability is not affected, and there is no evidence of lateral movement potential beyond the Statamic Control Panel context (GitHub Advisory).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-33887. The EPSS score is approximately 0.032% (0.000210), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires valid Control Panel credentials, limiting the attack surface to authenticated users (GitHub Advisory, Statamic Advisory).

1. Authenticate: Log in to the Statamic Control Panel with any valid low-privileged user account that has access to the panel but lacks permissions for specific collections.
2. Identify target collections: Enumerate collections that have revisions enabled (this may be inferred from the site's structure or through other accessible panel features).
3. Access revision endpoints: Send HTTP requests directly to the revision controller endpoints (e.g., /cp/collections/{collection}/entries/{entry}/revisions) for collections the user is not authorized to access via normal entry controllers.
4. Retrieve unauthorized data: The revision controller returns entry field values and blueprint data without enforcing collection-level authorization, exposing sensitive content.
5. Create unauthorized revisions (optional): Send a POST request to the revision creation endpoint for a restricted entry to snapshot its current state, even without edit permissions — this does not alter published content but confirms the authorization bypass (GitHub Advisory, Statamic Advisory).

• Logs: Unusual HTTP GET or POST requests to revision-related Control Panel routes (e.g., /cp/collections/*/entries/*/revisions) from users who do not have collection-level permissions, visible in web server or application access logs.
• Application Behavior: Revision creation events logged for entries in collections where the acting user has no edit permissions — check Statamic's activity/audit logs if enabled.
• Network: Repeated or scripted requests to revision endpoints across multiple collections from a single authenticated session, potentially indicating enumeration of restricted content.

Statamic has released patched versions 5.73.16 and 6.7.2 that enforce proper authorization checks in the revision controllers. Users should upgrade to one of these versions immediately. No configuration-based workaround is available; upgrading is the only remediation. Organizations should also audit Control Panel user permissions to ensure the principle of least privilege is applied (GitHub Advisory, Statamic Advisory).

The vulnerability was reported by a researcher credited as "offset" and published by Statamic maintainer jasonvarga on March 24, 2026. No significant broader media coverage or notable community commentary beyond the official advisory has been identified.