Statamic CMS versions between 6.0.0 and 6.3.x contain a flaw that allows an authenticated Control Panel user to bypass an intended verification step and gain higher privileges than originally granted. This is a CWE‑287 (Improper Authentication) vulnerability, stemming from improper authentication controls and can give the attacker access to sensitive operations, potentially compromising the entire site or its data. The pre‑existing user credentials are sufficient to exploit the flaw, so any user who can log into the Control Panel is at risk.

The impacted product is Statamic CMS. Users running the software versions 6.0.0 through 6.3.x (inclusive) are vulnerable. All installations of these versions that have a Control Panel layer are susceptible until the update to 6.4.0 is applied.

With a CVSS score of 8.8, the vulnerability is classified as high severity, yet the EPSS score is below 1%, indicating a low probability of exploitation in the wild so far. The flaw is not yet listed in the CISA KEV catalog, but it remains a critical concern for administrators who have active Control Panel users. Exploitation requires that the attacker gains entry to the Control Panel—either through legitimate credentials or compromised user accounts—then performs the privilege escalation by bypassing the expected verification step. Because the bug affects only authenticated users, the risk is confined to existing accounts and requires that the product be upgraded or otherwise mitigated to eliminate the elevation pathway.