CVE-2026-28424

6.5 mediumEPSS 0.3%

Medium (6.5) in statamic statamic. EPSS 0.3% chance of exploitation in the next 30 days.

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, user email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the "view users" permission. This has been fixed in 5.73.11 and 6.4.0.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 18% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2026-02-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

statamic:statamic

References

https://github.com/statamic/cms/releases/tag/v5.73.11
https://github.com/statamic/cms/releases/tag/v6.4.0
https://github.com/statamic/cms/security/advisories/GHSA-w878-f8c6-7r63

Check your stack JSON