Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.20 and 6.13.0, manipulating query parameters on Control Panel and …

Statamic CMS versions prior to 5.73.20 and 6.13.0 contain a vulnerability allowing manipulation of query parameters on Control Panel and REST API endpoints, or arguments in GraphQL queries, resulting in potential loss of content, assets, and user accounts. The Control Panel exploit requires minimal authentication permissions, while REST and GraphQL API exploits require no permissions but must be explicitly enabled. Sites with unauthenticated REST or GraphQL APIs should prioritize patching. Fixed in versions 5.73.20 and 6.13.0.