CVE-2026-64664

Received Received - Intake

Information Disclosure in Statamic CMS

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view users, though the endpoint only exposed user existence and not any other user data. This issue is fixed in versions 5.74.1 and 6.24.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-64664

Affected Vendors & Products

Vendor	Product	Version / Range
statamic	statamic	to 5.74.1 (inc)
statamic	statamic	to 6.24.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability in Statamic allows an authenticated Control Panel user to check if an email address belongs to an existing user without proper permission. The endpoint meant for user creation only reveals user existence, not other data. It affects versions before 5.74.1 and 6.24.0.

Impact Analysis

An attacker with Control Panel access could enumerate user emails, potentially aiding phishing or social engineering attacks. It exposes user existence but not sensitive data like passwords.

Compliance Impact

This vulnerability may violate data protection principles under GDPR and HIPAA by exposing user existence without consent. It could lead to non-compliance with privacy requirements for user data handling.

Mitigation Strategies

Update Statamic to version 5.74.1 or 6.24.0 or later to fix the vulnerability. Remove unnecessary user creation endpoint permissions for Control Panel users.

Hi! I’m here to help you understand CVE-2026-64664. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70