CVE-2026-28424 PUBLISHED

Statamic's missing authorization allows access to email addresses

Assigner: GitHub_M
Reserved: 27.02.2026 Published: 27.02.2026 Updated: 27.02.2026

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, user email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the "view users" permission. This has been fixed in 5.73.11 and 6.4.0.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 6.5

Product Status

Vendor statamic
Product cms
Versions
  • Version < 5.73.11 is affected
  • Version >= 6.0.0, < 6.4.0 is affected

References

Problem Types

  • CWE-862: Missing Authorization CWE