CVE-2026-64664

Summary

Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence

Severity

medium

CVSS

4.3

EPSS

0.3% (p27)

CWE

CWE-200, CWE-862

Also known as

GHSA-225x-3jhx-wh4q

Published

2026-08-06

Updated

2026-08-06

Advisory details

Impact

An authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belongs to an existing user, without having permission to view users.

The endpoint only exposed user existence, not any of its data.

Patches

This has been fixed in 5.74.1 and 6.24.0.

References

• https://github.com/advisories/GHSA-225x-3jhx-wh4q
• https://github.com/statamic/cms/security/advisories/GHSA-225x-3jhx-wh4q
• https://github.com/statamic/cms/pull/14905
• https://github.com/statamic/cms/commit/aea68053cedab5c79d10102820b57345a7d7102e
• https://github.com/statamic/cms/releases/tag/v5.74.1
• https://github.com/statamic/cms/releases/tag/v6.24.0

Related advisories

• GHSA-v2f8-6655-7grj — critical · PyPI/vibe-trading-ai
• GHSA-gg6r-gp4c-89hp — critical · npm/trigger.dev
• CVE-2026-91985 — high · Go/code.vikunja.io/api
• CVE-2026-107811 — high · Go/github.com/0xJacky/Nginx-UI
• CVE-2026-76089 — high · Packagist/verbb/formie
• CVE-2026-69197 — high · NuGet/Umbraco.Cms
• CVE-2026-72804 — high · Go/github.com/siyuan-note/siyuan/kernel
• CVE-2026-113668 — medium · npm/apostrophe

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity