Improper authorization control for web services In statamic/cms
Description
Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries
Impact
An authenticated Control Panel user could view content from entries they don't have permission to view, including entry content and custom field values, from any collection and including unpublished entries. No data could be modified.
Patches
This has been fixed in 5.74.1 and 6.24.0.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 packagist | 5.74.1, 6.24.0 |
Aliases
1. 2. 3. 4. 5.
References
1. 2. 3. 4. 5.