CVE-2026-64664

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view users, though the endpoint only exposed user existence and not any other user data. This issue is fixed in versions 5.74.1 and 6.24.0.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/statamic/cms/commit/aea68053cedab5c79d10102820b57345a7d7102e
https://github.com/statamic/cms/pull/14905
https://github.com/statamic/cms/releases/tag/v5.74.1
https://github.com/statamic/cms/releases/tag/v6.24.0
https://github.com/statamic/cms/security/advisories/GHSA-225x-3jhx-wh4q

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Statamic es un sistema de gestión de contenido (CMS) impulsado por Laravel y Git. Antes de las versiones 5.74.1 y 6.24.0, un usuario autenticado del Panel de Control podía usar un endpoint destinado al asistente de creación de usuarios para determinar si una dirección de correo electrónico dada pertenecía a un usuario existente, sin tener permiso para ver usuarios, aunque el endpoint solo exponía la existencia del usuario y no ningún otro dato del usuario. Este problema está solucionado en las versiones 5.74.1 y 6.24.0.

Information

Published : 2026-08-06 22:18

Updated : 2026-10-24 16:10

NVD link : CVE-2026-64664

Mitre link : CVE-2026-64664

CVE.ORG link : CVE-2026-64664

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-862

Missing Authorization

{"id": "CVE-2026-64664", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64664", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T15:36:53.174987Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "statamic", "product": "cms", "versions": [{"status": "affected", "version": ">= 6.0.0, < 6.24.0"}, {"status": "affected", "version": "< 5.74.1"}]}]}], "published": "2026-08-06T22:18:13.960", "references": [{"url": "https://github.com/statamic/cms/commit/aea68053cedab5c79d10102820b57345a7d7102e", "source": "security-advisories@github.com"}, {"url": "https://github.com/statamic/cms/pull/14905", "source": "security-advisories@github.com"}, {"url": "https://github.com/statamic/cms/releases/tag/v5.74.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/statamic/cms/releases/tag/v6.24.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/statamic/cms/security/advisories/GHSA-225x-3jhx-wh4q", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view users, though the endpoint only exposed user existence and not any other user data. This issue is fixed in versions 5.74.1 and 6.24.0."}, {"lang": "es", "value": "Statamic es un sistema de gesti\u00f3n de contenido (CMS) impulsado por Laravel y Git. Antes de las versiones 5.74.1 y 6.24.0, un usuario autenticado del Panel de Control pod\u00eda usar un endpoint destinado al asistente de creaci\u00f3n de usuarios para determinar si una direcci\u00f3n de correo electr\u00f3nico dada pertenec\u00eda a un usuario existente, sin tener permiso para ver usuarios, aunque el endpoint solo expon\u00eda la existencia del usuario y no ning\u00fan otro dato del usuario. Este problema est\u00e1 solucionado en las versiones 5.74.1 y 6.24.0."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "security-advisories@github.com"}