GitHub Advisoryadvisory · Packagist

GHSA-225x-3jhx-wh4q Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence

MEDIUM Published 2026-08-06 Modified 2026-08-06 Official page ↗
Aliases
CVE-2026-64664
Ecosystem
Packagist
Packages
statamic/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-862
Reviewed
2026-08-06

Affected packages

• Packagist statamic/cms: < 5.74.1 → fixed in 5.74.1 • Packagist statamic/cms: >= 6.0.0, < 6.24.0 → fixed in 6.24.0

Description

Impact An authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belongs to an existing user, without having permission to view users. The endpoint only exposed user existence, not any of its data. Patches This has been fixed in 5.74.1 and 6.24.0.

Related

Alias · CVE (1)

  • CVE-2026-64664 Statamic is a Laravel and Git powered content management system (CMS). vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-862 Missing Authorization weakness

References