Statamic CMS Markdown Preview Endpoint User Data Exposure Vulnerability

A vulnerability exists in Statamic CMS versions prior to 5.73.16 and 6.7.2, where the markdown preview endpoint can be exploited to access sensitive data from various fieldtypes. Specifically, an authenticated user in the control panel could use the users fieldtype to obtain private information such as email addresses, encrypted passkey data, and encrypted two-factor authentication codes.

Impact

Exploitation of this vulnerability allows for unauthorized access to sensitive user information, including email addresses and encrypted data related to authentication and account security.

Remediation

Users can upgrade to Statamic CMS versions 5.73.16 or 6.7.2 to address this vulnerability.