Statamic Taxonomy Term Creation Authorization Bypass Vulnerability

An authorization bypass vulnerability has been identified in Statamic CMS versions prior to 5.73.14 and 6.7.0. Low-privileged Control Panel users could exploit this vulnerability by sending requests to the field action processing endpoint with custom field definitions. This approach circumvented the authorization checks that are normally applied on the standard taxonomy term creation endpoint, allowing unauthorized users to create taxonomy terms.

Impact

Exploitation of this vulnerability allowed low-privileged Control Panel users to create taxonomy terms without proper authorization, by bypassing the standard authorization checks on the taxonomy term creation endpoint.

Remediation

Users can upgrade to Statamic CMS versions 5.73.14 or 6.7.0 to address this vulnerability.