CVE-2026-41175

OVERVIEW CVE-2026-41175 affects Statamic, a Laravel and Git-powered content management system, in versions prior to 5.73.20 and 6.13.0. The vulnerability allows attackers to manipulate query parameters on Control Panel and REST API endpoints, as well as arguments in GraphQL queries, resulting in unauthorized deletion of content, assets, and user accounts. The Control Panel exploitation requires minimal authenticated permissions, while REST and GraphQL API exploitation requires no permissions but depends on these interfaces being explicitly enabled without authentication. SEVERITY The vulnerability carries a CVSS score of 8.1 (HIGH) with a network-based attack vector requiring low complexity and low privileges. The attack requires user interaction to be disabled and impacts system integrity and availability through high-impact data destruction. The threat is particularly critical for organizations that have enabled REST or GraphQL APIs without authentication controls, as these endpoints bypass the authentication requirement entirely. EXPLOITATION STATUS There is no evidence of active exploitation, as the vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on the Hot List. The EPSS score of 0.00049 indicates extremely low probability of exploitation in the wild relative to other CVEs. However, organizations should prioritize patching if REST or GraphQL APIs are exposed without authentication, as the attack method is straightforward once these conditions are met.