GHSA-w878-f8c6-7r63
Statamic's missing authorization allows access to email addresses
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | statamic/cms | < 5.73.11 | 5.73.11 |
| Packagist | statamic/cms | >= 6.0.0-alpha.1, < 6.4.0 | 6.4.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
User email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the “view users” permission.
### Patches
This has been fixed in 5.73.11 and 6.4.0.
References
External links from the advisory. They lead to third-party sites.