Statamic, a Laravel‑based content management system, contains a flaw where a field action processing endpoint can be abused to create taxonomy terms without the required authorization checks. This weakness, classified as an authorization bypass (CWE‑862), lets users with minimal permissions add new terms by submitting crafted field definitions, potentially altering site content or navigation in ways the user should not be able to control.

The issue affects all Statamic installations running versions earlier than 5.73.14 for the 5.x branch and earlier than 6.7.0 for the 6.x branch. Only the CMS itself is vulnerable; plugins or themes do not add further risk beyond the core CMS behaviour.

The CVSS score of 4.3 indicates medium severity, while the EPSS score of less than 1% suggests only a small portion of attackers are expected to exploit this vulnerability. It is not listed in CISA’s KEV catalog. The vulnerability can be exploited through the Control Panel by submitting a crafted request to the field action endpoint, and thus it requires authenticated access, but only to a low‑privilege user account.