statamic/cms · Security
Statamic's missing authorization allows access to email addresses
- GHSA ID
- GHSA-w878-f8c6-7r63
- CVE ID
- CVE-2026-28424
- Severity
- medium
- Published
- Updated
- CVSS
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Description
Impact
User email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the “view users” permission.
Patches
This has been fixed in 5.73.11 and 6.4.0.
CWEs
- CWE-862 · Missing Authorization