CVE-2026-64664

MEDIUM 4.3

Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view users, though the endpoint only exposed user existence and not any other user data. This issue is fixed in versions 5.74.1 and 6.24.0.

CWE	CWE-200 CWE-862
Vendor	statamic
Product	cms
Published	Aug 6, 2026

Stay Ahead of the Next One

Get instant alerts for statamic cms

Be the first to know when new medium vulnerabilities affecting statamic cms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

statamic / cms

>= 6.0.0, < 6.24.0 < 5.74.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/statamic/cms/security/advisories/GHSA-225x-3jhx-wh4q github.com: https://github.com/statamic/cms/pull/14905 github.com: https://github.com/statamic/cms/commit/aea68053cedab5c79d10102820b57345a7d7102e github.com: https://github.com/statamic/cms/releases/tag/v5.74.1 github.com: https://github.com/statamic/cms/releases/tag/v6.24.0