Statamic CMS prior to versions 5.73.23 and 6.20.0 had an authorization flaw in the Control Panel fieldtype endpoints; an authenticated user with Control Panel access could retrieve metadata and content for resources they were not permitted to view, exposing entry titles, custom fields, asset details, and the existence of users, roles, and groups. The vulnerability allowed purely read‑only disclosure; no modification of data was possible.

The affected product is Statamic CMS, versions earlier than 5.73.23 for the 5.x series and earlier than 6.20.0 for the 6.x series; any installation that uses authenticated Control Panel users and these fieldtype endpoints is at risk.

The CVSS score of 4.3 indicates a moderate impact with low complexity; EPSS is not available, so exploitation probability is uncertain, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated Control Panel user; an internal attacker or compromised account could leverage legitimate credentials to access restricted resources. While the flaw is limited to read‑only disclosure, the exposed information could assist further attacks, such as credential enumeration or profiling of the organization.