Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
Statamic: Malicious Queries Can Delete Content and User Accounts
GHSA-4jjr-vmv7-wh4w
Summary
Statamic, a content management system, has a flaw that allows hackers to delete content, assets, and user accounts by manipulating certain queries. This can happen on the Control Panel with minimal permissions, or on the REST and GraphQL API if they are not properly secured. If your site uses these APIs without authentication, you should patch it as soon as possible to prevent data loss.
What to do
- Update statamic statamic/cms to version 5.73.20.
- Update statamic statamic/cms to version 6.13.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Packagist | statamic | statamic/cms |
< 5.73.20 >= 6.0.0-alpha.1, < 6.13.0 Fix: upgrade to 5.73.20
|
Original title
Statamic: Unsafe method invocation via query value resolution allows data destruction
Original description
### Impact
Manipulating query parameters on Control Panel and REST API endpoints, or arguments in GraphQL queries, could result in the loss of content, assets, and user accounts.
The Control Panel requires authentication with minimal permissions in order to exploit. e.g. "view entries" permission to delete entries, or "view users" permission to delete users, etc.
The REST and GraphQL API exploits do not require any permissions, however neither are enabled by default. In order to be exploited, they would need to be explicitly enabled with no authentication configured, and the specific resources enabled too.
Sites that enable the REST or GraphQL API without authentication should treat patching as critical priority.
### Patches
This has been fixed in 5.73.20 and 6.13.0.
Manipulating query parameters on Control Panel and REST API endpoints, or arguments in GraphQL queries, could result in the loss of content, assets, and user accounts.
The Control Panel requires authentication with minimal permissions in order to exploit. e.g. "view entries" permission to delete entries, or "view users" permission to delete users, etc.
The REST and GraphQL API exploits do not require any permissions, however neither are enabled by default. In order to be exploited, they would need to be explicitly enabled with no authentication configured, and the specific resources enabled too.
Sites that enable the REST or GraphQL API without authentication should treat patching as critical priority.
### Patches
This has been fixed in 5.73.20 and 6.13.0.
osv CVSS3.1
8.1
Vulnerability type
CWE-470
Published: 16 Apr 2026 · Updated: 16 Apr 2026 · First seen: 16 Apr 2026