CVE-2026-33882 statamic CVE debrief

Who should care

Defenders responsible for Statamic CMS instances, especially those with authenticated control panel users, should assess exposure and apply remediation to prevent potential sensitive user data disclosure.

Why it matters

CVE-2026-33882 is a medium-severity vulnerability in Statamic CMS that allows authenticated control panel users to manipulate the markdown preview endpoint and retrieve sensitive user data. Defenders should prioritize verifying exposure and remediation for Statamic CMS instances, especially those with authenticated control panel users, to prevent potential sensitive user data disclosure.

• Potential disclosure of sensitive user data, including email addresses, encrypted passkey data, and encrypted two-factor authentication codes
• Requires verification of Statamic CMS version and exposure to the markdown preview endpoint
• Remediation priority for Statamic CMS instances with authenticated control panel users

Technical summary

CVE-2026-33882 is a vulnerability in Statamic CMS that allows authenticated control panel users to manipulate the markdown preview endpoint and retrieve sensitive user data, including email addresses, encrypted passkey data, and encrypted two-factor authentication codes. The vulnerability has been fixed in versions 5.73.16 and 6.7.2. Defenders should prioritize verifying exposure and remediation for Statamic CMS instances, especially those with authenticated control panel users, to prevent potential sensitive user data disclosure. This vulnerability requires verification of Statamic CMS version and exposure to the markdown preview endpoint.

Defensive priority

Defenders should prioritize verifying exposure and remediation for Statamic CMS instances, especially those with authenticated control panel users, to prevent potential sensitive user data disclosure.

Recommended defensive actions

• Verify Statamic CMS version and apply patches to prevent sensitive user data disclosure
• Restrict access to the control panel to trusted users only
• Monitor for potential exploitation attempts on the markdown preview endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Statamic CMS, which could allow authenticated control panel users to retrieve sensitive user data. The vendor has released fixes in versions 5.73.16 and 6.7.2.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.