CVE-2026-28424 Details
Description
Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, user email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the "view users" permission. This has been fixed in 5.73.11 and 6.4.0.
A vulnerability in Statamic CMS versions prior to 5.73.11 and 6.4.0 allowed user email addresses to be included in responses from the user fieldtype's data endpoint. This issue affected control panel users without the 'view users' permission, leading to unauthorized access to email information.
Users can upgrade to Statamic CMS versions 5.73.11 or 6.4.0 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/statamic/cms/releases/tag/v5.73.11 | [email protected] | Release Notes |
| https://github.com/statamic/cms/releases/tag/v6.4.0 | [email protected] | Release Notes |
| https://github.com/statamic/cms/security/advisories/GHSA-w878-f8c6-7r63 | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| statamic statamic | < 5.73.11 >= 6.0.0, < 6.4.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 5, 2026 | Initial Analysis | [email protected] |
| Feb 27, 2026 | New CVE Received | [email protected] |