Executive brief
Statamic is a content management system used to build and manage websites. A security flaw in its administrative Control Panel allows a logged-in user to verify if specific email addresses are registered as users on the system, even if they do not have permission to view the user list. While this does not expose passwords or personal content, it could be used by an attacker to identify valid accounts for further targeted attacks.
Technical details
A missing authorization check (CWE-862) exists in a Statamic Control Panel endpoint intended for the user creation wizard. An authenticated attacker with low privileges (access to the Control Panel but without 'view users' permissions) can query this endpoint to determine if a specific email address is associated with an existing account. This results in the exposure of sensitive information (CWE-200) regarding user existence. The vulnerability is reachable over the network and requires no user interaction. Patches are available in versions 5.74.1 and 6.24.0.
Affected products
- Statamic Statamic CMS < 5.74.1, >= 6.0.0, < 6.24.0
Timeline
- 2026-07-02: disclosed: Initial disclosure to vendor
- 2026-08-06: advisory: GitHub Advisory published
- 2026-08-06: patched: Fixes released in versions 5.74.1 and 6.24.0