CVE-2026-64664: Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence
An authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belongs to an existing user, without having permission to view users.
The endpoint only exposed user existence, not any of its data.
References
- github.com/advisories/GHSA-225x-3jhx-wh4q
- github.com/statamic/cms/commit/aea68053cedab5c79d10102820b57345a7d7102e
- github.com/statamic/cms/pull/14905
- github.com/statamic/cms/releases/tag/v5.74.1
- github.com/statamic/cms/releases/tag/v6.24.0
- github.com/statamic/cms/security/advisories/GHSA-225x-3jhx-wh4q
- nvd.nist.gov/vuln/detail/CVE-2026-64664
Code Behaviors & Features
Detect and mitigate CVE-2026-64664 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →