VULNERABILITY INTELLIGENCE

CVE-2026-27939

CVSS score8.8 HIGH
EPSS probability0.43%
CISA KEVNot currently listed
Published2026-02-27
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

Statmatic is a Laravel and Git powered content management system (CMS). Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel users may under certain conditions obtain elevated privileges without completing the intended verification step. This can allow access to sensitive operations and, depending on the user’s existing permissions, may lead to privilege escalation. This has been fixed in 6.4.0.

Weakness classification

  • security-advisories@github.com: CWE-287
  • nvd@nist.gov: NVD-CWE-noinfo

Primary references