CVE-2026-28424
Statamic's missing authorization allows access to email addresses
Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, user email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the "view users" permission. This has been fixed in 5.73.11 and 6.4.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Statamic's missing authorization allows access to email addresses
Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, user email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the "view users" permission. This has been fixed in 5.73.11 and 6.4.0.
- Record
CVE-2026-28424- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2026-9093
Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, user email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the "view users" permission. This has been fixed in 5.73.11 and 6.4.0.
- Record
EUVD-2026-9093- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w878-f8c6-7r63
Statamic's missing authorization allows access to email addresses
Impact
User email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the “view users” permission.
Patches
This has been fixed in 5.73.11 and 6.4.0.
- Record
GHSA-w878-f8c6-7r63- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
NVD
Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, user email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the "view users" permission. This has been fixed in 5.73.11 and 6.4.0.
- Record
CVE-2026-28424- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSV
Statamic's missing authorization allows access to email addresses
Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, user email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the "view users" permission. This has been fixed in 5.73.11 and 6.4.0.
- Record
CVE-2026-28424- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVGHSA-w878-f8c6-7r63
Statamic's missing authorization allows access to email addresses
Impact
User email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the “view users” permission.
Patches
This has been fixed in 5.73.11 and 6.4.0.
- Record
GHSA-w878-f8c6-7r63- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
statamic/cmsPackagist |
before 5.73.11 | 5.73.11 |
statamic/cmsPackagist |
6.0.0-alpha.1 up to 6.4.0 | 6.4.0 |
statamic/cmsPackagist |
before 5.73.11, plus listed versions v3.0.0v3.0.0-beta.1v3.0.0-beta.10v3.0.0-beta.11v3.0.0-beta.12 Show 45 moreShow lessv3.0.0-beta.13v3.0.0-beta.14v3.0.0-beta.15v3.0.0-beta.16v3.0.0-beta.17v3.0.0-beta.18v3.0.0-beta.19v3.0.0-beta.2v3.0.0-beta.20v3.0.0-beta.21v3.0.0-beta.22v3.0.0-beta.23v3.0.0-beta.24v3.0.0-beta.25v3.0.0-beta.26v3.0.0-beta.27v3.0.0-beta.28v3.0.0-beta.29v3.0.0-beta.3v3.0.0-beta.30v3.0.0-beta.31v3.0.0-beta.32v3.0.0-beta.33v3.0.0-beta.34v3.0.0-beta.35v3.0.0-beta.36v3.0.0-beta.37v3.0.0-beta.38v3.0.0-beta.39v3.0.0-beta.4v3.0.0-beta.40v3.0.0-beta.41v3.0.0-beta.42v3.0.0-beta.43v3.0.0-beta.44v3.0.0-beta.45v3.0.0-beta.46v3.0.0-beta.5v3.0.0-beta.6v3.0.0-beta.7v3.0.0-beta.8v3.0.0-beta.9v3.0.1v3.0.10v3.0.11 |
5.73.11 |
statamic/cmsPackagist |
6.0.0-alpha.1 up to 6.4.0, plus listed versions v6.0.0v6.0.0-alpha.1v6.0.0-alpha.10v6.0.0-alpha.11v6.0.0-alpha.12 Show 34 moreShow lessv6.0.0-alpha.13v6.0.0-alpha.14v6.0.0-alpha.15v6.0.0-alpha.16v6.0.0-alpha.17v6.0.0-alpha.18v6.0.0-alpha.19v6.0.0-alpha.2v6.0.0-alpha.20v6.0.0-alpha.21v6.0.0-alpha.3v6.0.0-alpha.4v6.0.0-alpha.5v6.0.0-alpha.6v6.0.0-alpha.7v6.0.0-alpha.8v6.0.0-alpha.9v6.0.0-beta.1v6.0.0-beta.2v6.0.0-beta.3v6.0.0-beta.4v6.0.0-beta.5v6.0.0-beta.6v6.1.0v6.2.0v6.2.1v6.2.2v6.2.3v6.2.4v6.2.5v6.3.0v6.3.1v6.3.2v6.3.3 |
6.4.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-28424 is a medium vulnerability (CVSS 6.5) in Statamic Cms, published February 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in statamic/cms 5.73.11.
References
github.com/statamic/cms/security/advisories/GHSA-w878-f8c6-7r63
nvd.nist.gov/vuln/detail/CVE-2026-28424
Left out here: 433 versions. The JSON record has them.