Statamic is vulnerable because manipulating query parameters on Control Panel and REST API endpoints and arguments in GraphQL queries can trigger unsafe method invocation, resulting in deletion of content, assets, or user accounts. The Control Panel requires authentication, but only minimal permissions such as 'view entries' to delete entries or 'view users' to delete users are required. The REST and GraphQL API exploits do not require any permissions; however, they must be explicitly enabled with no authentication, and the specific resources must be enabled as well.

Statamic CMS versions prior to 5.73.20 for the 5.x line and prior to 6.13.0 for the 6.x line are affected. The vulnerability applies to sites running these releases where Control Panel, REST API, or GraphQL API endpoints are exposed.

The CVSS score of 8.1 indicates high severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the attack vector is clear: an attacker can manipulate query values or API calls to invoke arbitrary methods. Control Panel exploitation requires an authenticated user with minimal permissions, while REST and GraphQL exploitation is trivial if the endpoints are enabled without authentication. Given that these APIs are disabled by default, the risk is highest for sites that have them enabled or for sites that have been compromised and have legitimate credentials. Patching to the fixed releases is strongly recommended.