Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-28424

Statamic's missing authorization allows access to email addresses

Description

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, user email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the "view users" permission. This has been fixed in 5.73.11 and 6.4.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

statamic cms

  • < 5.73.11affected
  • >= 6.0.0, < 6.4.0affected

References