~ / search / GHSA-225x-3jhx-wh4q

GHSA-225x-3jhx-wh4q

Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-64664

Packages

EcosystemPackageAffectedFixed in
Packagist statamic/cms < 5.74.1 5.74.1
Packagist statamic/cms >= 6.0.0, < 6.24.0 6.24.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact An authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belongs to an existing user, without having permission to view users. The endpoint only exposed user existence, not any of its data. ### Patches This has been fixed in 5.74.1 and 6.24.0.

References

External links from the advisory. They lead to third-party sites.