GitHub Advisoryadvisory · Packagist

GHSA-w878-f8c6-7r63 Statamic's missing authorization allows access to email addresses

MEDIUM Published 2026-03-01 Modified 2026-03-01 Official page ↗
Aliases
CVE-2026-28424
Ecosystem
Packagist
Packages
statamic/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-862
Reviewed
2026-03-01

Affected packages

• Packagist statamic/cms: < 5.73.11 → fixed in 5.73.11 • Packagist statamic/cms: >= 6.0.0-alpha.1, < 6.4.0 → fixed in 6.4.0

Description

Impact User email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the “view users” permission. Patches This has been fixed in 5.73.11 and 6.4.0.

Related

Alias · CVE (1)

  • CVE-2026-28424 Statmatic is a Laravel and Git powered content management system (CMS). vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References