CVE-2026-41175
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedStatamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.20 and 6.13.0, manipulating query parameters on Control Panel and REST API endpoints, or arguments in GraphQL queries, could result in the loss of content, assets, and user accounts. The Control Panel requires authentication with minimal permissions in order to exploit. e.g. "view entries" permission to delete entries, or "view users" permission to delete users, etc. The REST and GraphQL API exploits do not require any permissions, however neither are enabled by default. In order to be exploited, they would need to be explicitly enabled with no authentication configured, and the specific resources enabled too. Sites that enable the REST or GraphQL API without authentication should treat patching as critical priority. This has been fixed in 5.73.20 and 6.13.0.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceStatamic CMS prior to versions 5.73.20 and 6.13.0 allows authenticated users with minimal view permissions (e.g., 'view entries' or 'view users') to delete content, assets, and user accounts by manipulating query parameters in the Control Panel. Additionally, REST and GraphQL APIs (if enabled without authentication) allow unauthenticated attackers to delete the same resources via manipulated query arguments.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 5.73.20>= 6.0.0, < 6.13.0CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Check installed Statamic versionLocate the version file or run a command to display the current Statamic installation version (typically found in composer.json or via Statamic CLI)Affected if The installed version is less than 5.73.20, or greater than or equal to 6.0.0 but less than 6.13.0
-
Identify REST API exposureExamine the Statamic configuration files and routes to determine if the REST API endpoint is accessible. Check if the API requires authentication by reviewing the API configuration settings.Affected if REST API is enabled and configured to allow unauthenticated (public) access
-
Identify GraphQL API exposureExamine the Statamic configuration files and routes to determine if the GraphQL endpoint is accessible. Check if GraphQL requires authentication in the configuration.Affected if GraphQL API is enabled and configured to allow unauthenticated (public) access
-
Review Control Panel user permissionsReview user roles and permissions in the Control Panel, specifically looking for users with minimal view permissions (such as 'view entries' or 'view users')Affected if Users exist with only view permissions who should not have deletion capabilities
You are affected if your Statamic version falls within the vulnerable ranges AND either unauthenticated REST/GraphQL APIs are exposed OR users with only view permissions can access deletion functionality in the Control Panel.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped5.73.206.13.0
Upgrade to Statamic version 5.73.20 or 6.13.0 immediately. Organizations with unauthenticated REST or GraphQL APIs enabled should treat this as critical priority given the CVSS 8.1 severity and potential for complete content/user loss.
Statamic 5.73.20 (for 5.x branch) or 6.13.0 (for 6.x branch)
- Backup your Statamic site and database before proceeding with the update
- If you are running Statamic 5.x, upgrade to version 5.73.20 or later (e.g., composer update statamic/cms:^5.73.20)
- If you are running Statamic 6.x, upgrade to version 6.13.0 or later (e.g., composer update statamic/cms:^6.13.0)
- Clear any caches after upgrading (php artisan cache:clear)
- Verify the upgrade was successful by checking the Statamic version (php artisan statamic:version)
- Review the application to confirm content, assets, and user accounts are intact
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation3.0 h
- Implementation2.0 h
- Testing4.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,072.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-41175 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-41175 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data