Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
Statamic: Unauthenticated data loss via malicious API or GraphQL queries
GHSA-4jjr-vmv7-wh4w
Summary
Statamic's REST and GraphQL APIs can be exploited to delete content, assets, and user accounts without authentication, if they are enabled on a site. Sites that have these APIs enabled without authentication should prioritize patching to prevent data loss. Update to Statamic 5.73.20 or 6.13.0 to fix this issue.
What to do
- Update statamic cms to version 5.73.20.
- Update statamic cms to version 6.13.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | statamic | cms |
< 5.73.20 >= 6.0.0-alpha.1, < 6.13.0 Fix: upgrade to 5.73.20
|
Original title
Statamic: Unsafe method invocation via query value resolution allows data destruction
Original description
### Impact
Manipulating query parameters on Control Panel and REST API endpoints, or arguments in GraphQL queries, could result in the loss of content, assets, and user accounts.
The Control Panel requires authentication with minimal permissions in order to exploit. e.g. "view entries" permission to delete entries, or "view users" permission to delete users, etc.
The REST and GraphQL API exploits do not require any permissions, however neither are enabled by default. In order to be exploited, they would need to be explicitly enabled with no authentication configured, and the specific resources enabled too.
Sites that enable the REST or GraphQL API without authentication should treat patching as critical priority.
### Patches
This has been fixed in 5.73.20 and 6.13.0.
Manipulating query parameters on Control Panel and REST API endpoints, or arguments in GraphQL queries, could result in the loss of content, assets, and user accounts.
The Control Panel requires authentication with minimal permissions in order to exploit. e.g. "view entries" permission to delete entries, or "view users" permission to delete users, etc.
The REST and GraphQL API exploits do not require any permissions, however neither are enabled by default. In order to be exploited, they would need to be explicitly enabled with no authentication configured, and the specific resources enabled too.
Sites that enable the REST or GraphQL API without authentication should treat patching as critical priority.
### Patches
This has been fixed in 5.73.20 and 6.13.0.
ghsa CVSS3.1
8.1
Vulnerability type
CWE-470
Published: 16 Apr 2026 · Updated: 16 Apr 2026 · First seen: 16 Apr 2026