CVE-2026-28424: Statamic's missing authorization allows access to email addresses
Impact User email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the “view users” permission.
Patches This has been fixed in 5.73.11 and 6.4.0.
Other sources
Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, user email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the "view users" permission. This has been fixed in 5.73.11 and 6.4.0.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28424?
CVE-2026-28424 has a medium severity rating due to its potential for unauthorized access to sensitive user email addresses.
How do I fix CVE-2026-28424?
To fix CVE-2026-28424, upgrade Statamic to version 5.73.11 or later, or version 6.4.0 or later.
What types of data are exposed due to CVE-2026-28424?
CVE-2026-28424 exposes user email addresses which could be accessed by unauthorized control panel users.
Which versions of Statamic are affected by CVE-2026-28424?
CVE-2026-28424 affects Statamic versions prior to 5.73.11 and 6.4.0.
Is user intervention required for protecting against CVE-2026-28424?
Yes, user intervention is required to upgrade affected Statamic versions to mitigate CVE-2026-28424.