CVE-2017-11422: Statamic

High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days.

Statamic framework before 2.6.0 does not correctly check a session's permissions when the methods from a user's class are called. Problematic methods include reset password, create new account, create new role, etc.

Affected products

• Statamic Statamic: before 2.6.0 (fixed in 2.6.0)

Published 2017-07-24. Last modified 2026-06-17.