CVE-2026-44306

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.21 and 6.15.0, responses from the forgot password forms hinted at whether an account existed for a given email address. An unauthenticated attacker could use this to enumerate valid users, which can aid in follow-up credential-based attacks. This vulnerability is fixed in 5.73.21 and 6.15.0.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/statamic/cms/security/advisories/GHSA-m24v-f7g5-gq67

Configurations

No configuration.

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) Statamic es un sistema de gestión de contenidos (CMS) impulsado por Laravel y Git. Antes de las versiones 5.73.21 y 6.15.0, las respuestas de los formularios de ’olvidé mi contraseña’ insinuaban si existía una cuenta para una dirección de correo electrónico determinada. Un atacante no autenticado podría usar esto para enumerar usuarios válidos, lo que puede ayudar en ataques posteriores basados en credenciales. Esta vulnerabilidad está corregida en las versiones 5.73.21 y 6.15.0.

Information

Published : 2026-05-12 22:16

Updated : 2026-10-26 14:10

NVD link : CVE-2026-44306

Mitre link : CVE-2026-44306

CVE.ORG link : CVE-2026-44306

JSON object : View

Products Affected

No product.

CWE

CWE-204

Observable Response Discrepancy

{"id": "CVE-2026-44306", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44306", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T18:15:50.669186Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "statamic", "product": "cms", "versions": [{"status": "affected", "version": "< 5.73.21"}, {"status": "affected", "version": ">= 6.0.0, < 6.15.0"}]}]}], "published": "2026-05-12T22:16:37.413", "references": [{"url": "https://github.com/statamic/cms/security/advisories/GHSA-m24v-f7g5-gq67", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-204"}]}], "descriptions": [{"lang": "en", "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.21 and 6.15.0, responses from the forgot password forms hinted at whether an account existed for a given email address. An unauthenticated attacker could use this to enumerate valid users, which can aid in follow-up credential-based attacks. This vulnerability is fixed in 5.73.21 and 6.15.0."}, {"lang": "es", "value": "Statamic es un sistema de gesti\u00f3n de contenidos (CMS) impulsado por Laravel y Git. Antes de las versiones 5.73.21 y 6.15.0, las respuestas de los formularios de \u2019olvid\u00e9 mi contrase\u00f1a\u2019 insinuaban si exist\u00eda una cuenta para una direcci\u00f3n de correo electr\u00f3nico determinada. Un atacante no autenticado podr\u00eda usar esto para enumerar usuarios v\u00e1lidos, lo que puede ayudar en ataques posteriores basados en credenciales. Esta vulnerabilidad est\u00e1 corregida en las versiones 5.73.21 y 6.15.0."}], "lastModified": "2026-10-26T14:10:00.130", "sourceIdentifier": "security-advisories@github.com"}