Statamic CMS contains a critical vulnerability allowing for the unauthorized deletion of content, assets, and user accounts through manipulated input parameters.

This is an unsafe reflection vulnerability (CWE-470) where external input controls class or code selection. Exploitation via the Control Panel requires authenticated users with minimal permissions, while exploitation of the REST and GraphQL APIs can be unauthenticated if those features are enabled without configured authentication.

The potential for unauthorized deletion of content, assets, and user accounts poses a significant risk to data integrity and business operations. With a CVSS score of 8.1, the vulnerability is classified as High severity. If APIs are exposed without authentication, the impact is elevated, as it allows external actors to disrupt services or destroy critical business data without prior access to the system.

Immediate Action: Update Statamic CMS to version 5.73.20 or 6.13.0 immediately. If an update cannot be performed, disable the REST and GraphQL APIs if they are not strictly required for business functionality.

Proactive Monitoring: Review access logs for unusual patterns involving query parameter manipulation or unexpected calls to API endpoints. Monitor administrative logs for unauthorized deletions of users or content entries.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block suspicious input strings within query parameters and API requests. Ensure that all API endpoints are protected by robust authentication mechanisms to prevent unauthorized access.

Public Exploit Available: No (exploit_available: false)

Given the potential for permanent data loss and the ease of exploitation when APIs are misconfigured, this vulnerability requires immediate attention. Administrators must prioritize updating to the patched versions or enforcing authentication on all exposed API interfaces to prevent potential service disruption and data compromise.