Executive brief
Statamic is a content management system used to build and manage websites. A security flaw in the 'forgot password' feature allowed unauthorized individuals to determine if a specific email address was registered with the site. This information could be used by attackers to identify valid user accounts for targeted phishing or password-guessing attacks.
Technical details
A CWE-204 (Observable Response Discrepancy) vulnerability exists in Statamic CMS prior to versions 5.73.21 and 6.15.0. The 'forgot password' form provided different responses depending on whether the submitted email address existed in the system. An unauthenticated, remote attacker could exploit this behavior to automate the enumeration of valid user accounts. This information disclosure facilitates subsequent credential-based attacks such as brute-forcing or targeted social engineering. The issue has been resolved by ensuring the application returns a generic, uniform response regardless of the account's existence.
Affected products
- Statamic Statamic CMS < 5.73.21, < 6.15.0
Timeline
- 2026-04-28: advisory: GitHub Security Advisory published by vendor
- 2026-05-12: disclosed: CVE published to NVD