An Endpoint That Answered the Wrong Question: CVE-2026-64664 in Statamic

Authorization bugs rarely look dramatic. There's no payload, no shell, no alert box. There's just an endpoint quietly answering a question it was never supposed to answer for the person asking. CVE-20