The vulnerability is a missing authorization check that allows users who lack permission to view assets to download them and view their metadata. The impact is a moderate confidentiality breach, exposing potentially sensitive files to unprivileged authenticated users. The weakness falls under CWE‑862, representing a lack of proper authorization checks.

Statamic CMS is affected. Versions prior to 5.73.6 for the 5.x line and prior to 6.2.5 for the 6.x line are susceptible. The issue does not affect logged‑out users or those without control‑panel access.

The CVSS score of 4.3 indicates low to moderate severity. The EPSS score of less than 1% suggests a very low chance of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attacks require authentication but do not need explicit asset‑access permissions, so the attack surface is limited to users who can log in but lack appropriate read privileges.