Is CVE-2026-49288 actively exploited?

No active exploitation of CVE-2026-49288 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-49288 be exploited remotely?

Yes. CVE-2026-49288 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-49288?

CVE-2026-49288 has a CVSS score of 4.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-49288

MEDIUM

CVE-2026-49288

CWE-200Published: June 19, 2026· Updated: Jun 23, 2026

4.3

CVSS v3.1

Official Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Control Panel user could view metadata and content for resources they don't have permission to view, including entries, assets, users, roles, groups, and other configured resources. Depending on the resource, this could expose titles, custom field values, entry content, asset metadata, and the existence of users, roles, and groups. No data could be modified. This has been fixed in 5.73.23 and 6.20.0.

NVD Source

Technical Analysis

CVE-2026-49288 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

From a weakness classification perspective (CWE-200): Information exposure vulnerabilities leak sensitive data to unauthorized actors.