Vulnerabilities CVE-2026-64664

CVE-2026-64664

Medium

Open

TLP:CLEAR

Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view users, though the endpoint only exposed user existence and not any other user data. This issue is fixed in versions 5.74.1 and 6.24.0.

Details

CVSS Score: 4.3
EPSS Score ⓘ: 0.25%

16.6th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Confidence: 90%
Published: Aug 6, 2026
Last Modified: Aug 7, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.