CVE-2026-44306
Statamic: Email enumeration via forgot password endpoint
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.21 and 6.15.0, responses from the forgot password forms hinted at whether an account existed for a given email address. An unauthenticated attacker could use this to enumerate valid users, which can aid in follow-up credential-based attacks. This vulnerability is fixed in 5.73.21 and 6.15.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Statamic: Email enumeration via forgot password endpoint
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.21 and 6.15.0, responses from the forgot password forms hinted at whether an account existed for a given email address. An unauthenticated attacker could use this to enumerate valid users, which can aid in follow-up credential-based attacks. This vulnerability is fixed in 5.73.21 and 6.15.0.
- Record
CVE-2026-44306- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-204
- Updated
- 2026-11-02
EUVDEUVD-2026-29866
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.21 and 6.15.0, responses from the forgot password forms hinted at whether an account existed for a given email address. An unauthenticated attacker could use this to enumerate valid users, which can aid in follow-up credential-based attacks. This vulnerability is fixed in 5.73.21 and 6.15.0.
- Record
EUVD-2026-29866- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-m24v-f7g5-gq67
Statamic CMS vulnerable to email enumeration via forgot password endpoint
Impact
Responses from the forgot password forms hinted at whether an account existed for a given email address. An unauthenticated attacker could use this to enumerate valid users, which can aid in follow-up credential-based attacks.
Patches
This has been fixed in 5.73.21 and 6.15.0. The forgot password forms now return the same generic response regardless of whether the submitted email matches a registered user.
- Record
GHSA-m24v-f7g5-gq67- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-204
- Updated
- 2026-11-02
NVD
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.21 and 6.15.0, responses from the forgot password forms hinted at whether an account existed for a given email address. An unauthenticated attacker could use this to enumerate valid users, which can aid in follow-up credential-based attacks. This vulnerability is fixed in 5.73.21 and 6.15.0.
- Record
CVE-2026-44306- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-204
- Updated
- 2026-11-02
OSV
Statamic: Email enumeration via forgot password endpoint
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.21 and 6.15.0, responses from the forgot password forms hinted at whether an account existed for a given email address. An unauthenticated attacker could use this to enumerate valid users, which can aid in follow-up credential-based attacks. This vulnerability is fixed in 5.73.21 and 6.15.0.
- Record
CVE-2026-44306- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-204
- Updated
- 2026-11-02
OSVGHSA-m24v-f7g5-gq67
Statamic CMS vulnerable to email enumeration via forgot password endpoint
Impact
Responses from the forgot password forms hinted at whether an account existed for a given email address. An unauthenticated attacker could use this to enumerate valid users, which can aid in follow-up credential-based attacks.
Patches
This has been fixed in 5.73.21 and 6.15.0. The forgot password forms now return the same generic response regardless of whether the submitted email matches a registered user.
- Record
GHSA-m24v-f7g5-gq67- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-204
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
statamic/cmsPackagist |
before 5.73.21 | 5.73.21 |
statamic/cmsPackagist |
6.0.0 up to 6.15.0 | 6.15.0 |
statamic/cmsPackagist |
before 5.73.21, plus listed versions v3.0.0v3.0.0-beta.1v3.0.0-beta.10v3.0.0-beta.11v3.0.0-beta.12 Show 45 moreShow lessv3.0.0-beta.13v3.0.0-beta.14v3.0.0-beta.15v3.0.0-beta.16v3.0.0-beta.17v3.0.0-beta.18v3.0.0-beta.19v3.0.0-beta.2v3.0.0-beta.20v3.0.0-beta.21v3.0.0-beta.22v3.0.0-beta.23v3.0.0-beta.24v3.0.0-beta.25v3.0.0-beta.26v3.0.0-beta.27v3.0.0-beta.28v3.0.0-beta.29v3.0.0-beta.3v3.0.0-beta.30v3.0.0-beta.31v3.0.0-beta.32v3.0.0-beta.33v3.0.0-beta.34v3.0.0-beta.35v3.0.0-beta.36v3.0.0-beta.37v3.0.0-beta.38v3.0.0-beta.39v3.0.0-beta.4v3.0.0-beta.40v3.0.0-beta.41v3.0.0-beta.42v3.0.0-beta.43v3.0.0-beta.44v3.0.0-beta.45v3.0.0-beta.46v3.0.0-beta.5v3.0.0-beta.6v3.0.0-beta.7v3.0.0-beta.8v3.0.0-beta.9v3.0.1v3.0.10v3.0.11 |
5.73.21 |
statamic/cmsPackagist |
6.0.0 up to 6.15.0, plus listed versions v6.0.0v6.1.0v6.10.0v6.11.0v6.12.0 Show 25 moreShow lessv6.13.0v6.14.0v6.2.0v6.2.1v6.2.2v6.2.3v6.2.4v6.2.5v6.3.0v6.3.1v6.3.2v6.3.3v6.4.0v6.4.1v6.5.0v6.6.0v6.6.1v6.6.2v6.6.3v6.7.0v6.7.1v6.7.2v6.7.3v6.8.0v6.9.0 |
6.15.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-44306 is a medium vulnerability (CVSS 5.3) in Statamic Cms, published May 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 10th percentile. Fixed in statamic/cms 5.73.21.
References
Left out here: 443 versions. The JSON record has them.