Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view users, though the endpoint only exposed user existence and not any other user data. This issue is fixed in versions 5.74.1 and 6.24.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-06T22:18:13.960Z",
  "pubdate": "2026-08-06T22:18:13.960Z",
  "executiveSummary": "Statamic prior to versions 5.74.1 and 6.24.0 contains an information disclosure vulnerability specifically manifesting as an account enumeration flaw.\nThe vulnerability allows an authenticated Control Panel user lacking user-viewing privileges to determine the existence of specific email addresses within the system.\nThe impact is limited to confirming whether a given email address belongs to an existing user account, without exposing any additional user data or personally identifiable information.\nThe risk implication centers on reconnaissance capability, where attackers with low-privileged control panel access can harvest valid system usernames or email addresses for subsequent targeted attacks such as credential stuffing or social engineering.\nExploitation requirements dictate that the threat actor must already possess authenticated access to the Statamic Control Panel, albeit without administrative or user-management privileges.\nThe attack vector leverages an endpoint originally intended for the internal user creation wizard, which improperly processes email validation or existence checks without adequately verifying the caller's authorization level against user-reading capabilities.",
  "technicalDetails": "The root cause of this vulnerability lies in insufficient authorization checks within an endpoint associated with the user creation wizard in Statamic.\nThe vulnerable component is the administrative endpoint responsible for handling user creation workflow logic, specifically the routine that validates or processes email addresses during wizard execution.\nAffected software versions include all Statamic installations prior to 5.74.1 and 6.24.0.\nAuthentication requirements specify that the attacker must be authenticated to the Statamic Control Panel, meaning completely unauthenticated external actors cannot exploit this flaw directly over the network without prior session establishment.\nPrivilege requirements are minimal; an authenticated user possessing standard, non-privileged access—specifically lacking permissions to view the user list—can successfully trigger the vulnerable condition.\nNetwork exposure is restricted to the web application interface where the Control Panel is exposed, typically accessible via HTTP/HTTPS protocols.\nThe attack flow proceeds as follows: First, the low-privileged attacker authenticates to the Statamic Control Panel. Second, the attacker formulates an HTTP request targeted at the user creation wizard endpoint, supplying a candidate email address as a parameter. Third, the backend controller processes the request through the wizard logic, checking internal data repositories for the existence of the provided email address. Fourth, based on the application response or HTTP status code returned by the endpoint, the attacker can infer whether the email address is currently registered to an active user account. Fifth, by iterating through a dictionary or list of target email addresses, the attacker systematically constructs a roster of valid system accounts.\nPayload behavior involves submitting crafted input to the wizard endpoint to elicit differential responses indicating account presence or absence.\nPost-exploitation impact is strictly bounded to reconnaissance; the vulnerability does not allow remote code execution, privilege escalation, or direct data exfiltration beyond binary confirmation of account existence."
}