{"id":"GHSA-hcch-w73c-jp4m","aliases":["CVE-2026-32612"],"title":"Statamic vulnerable to privilege escalation via stored cross-site scripting","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"### Impact\n\nStored XSS in the control panel color mode preference allows authenticated users with control panel access to inject malicious JavaScript that executes when a higher-privileged user impersonates their account.\n\n### Patches\n\nThis has been fixed in 6.6.2.","severity":"medium","score":5.4,"published":"2026-03-13T20:50:51.000Z","modified":"2026-03-16T17:16:53.164Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"statamic/cms","sources":[{"name":"OSV · GHSA-hcch-w73c-jp4m","url":"https://osv.dev/vulnerability/GHSA-hcch-w73c-jp4m"}],"ranges":[{"events":[{"introduced":"6.0.0"},{"fixed":"6.6.2"}],"type":"ECOSYSTEM"}],"versions":["v6.0.0","v6.1.0","v6.2.0","v6.2.1","v6.2.2","v6.2.3","v6.2.4","v6.2.5","v6.3.0","v6.3.1","v6.3.2","v6.3.3","v6.4.0","v6.4.1","v6.5.0","v6.6.0","v6.6.1"],"fixed":["6.6.2"]}],"sourceAffected":[],"references":["https://github.com/statamic/cms/security/advisories/GHSA-hcch-w73c-jp4m","https://nvd.nist.gov/vuln/detail/CVE-2026-32612","https://github.com/Shirshaw64p/security-advisories/tree/main/CVE-2026-32612","https://github.com/statamic/cms"],"sources":[{"name":"OSV","id":"GHSA-hcch-w73c-jp4m","modified":"2026-03-16T17:16:53.164579Z","url":"https://osv.dev/vulnerability/GHSA-hcch-w73c-jp4m"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","score":5.4}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T21:45:31.439Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}