CVE-2026-64664 in cms
Summary
by MITRE • 08/07/2026
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view users, though the endpoint only exposed user existence and not any other user data. This issue is fixed in versions 5.74.1 and 6.24.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability affects Statamic CMS versions prior to 5.74.1 and 6.24.0, where an authenticated Control Panel user could exploit a misconfigured endpoint to perform user enumeration attacks. The flaw resides in the user creation wizard endpoint which was designed to validate email addresses during the registration process but was improperly restricted in its access controls. An attacker with access to the control panel could leverage this endpoint to determine whether specific email addresses were already registered within the system, effectively bypassing normal permission checks that should prevent such information disclosure.
The technical implementation of this vulnerability stems from insufficient authorization validation within the user creation wizard functionality. When an authenticated user accesses the endpoint intended for new user registration, the system fails to properly verify that the requesting user has appropriate permissions to perform existence checks on other users. This represents a classic case of insufficient authorization control where the same endpoint used for legitimate user creation purposes can be abused for reconnaissance activities. The vulnerability falls under CWE-284 Access Control Issues, specifically related to improper access control mechanisms that allow unauthorized information disclosure.
The operational impact of this vulnerability extends beyond simple information gathering, as it enables attackers to perform targeted enumeration attacks against user bases within the CMS. An attacker could systematically test email addresses to identify which ones are already registered, potentially facilitating social engineering campaigns, brute force attacks against existing accounts, or targeted phishing operations. This type of reconnaissance capability significantly weakens the overall security posture by providing attackers with valuable intelligence about legitimate user accounts. The vulnerability aligns with ATT&CK technique T1087.001 Account Discovery, where adversaries seek to identify valid accounts within a target environment.
The fix implemented in versions 5.74.1 and 6.24.0 addresses this issue by strengthening authorization controls on the user creation endpoint. The patch ensures that proper permission checks are enforced when accessing the wizard functionality, preventing authenticated users from performing existence checks on other users without appropriate privileges. This remediation follows security best practices for access control implementation and demonstrates the importance of applying principle of least privilege principles to all endpoints within web applications. Organizations using affected Statamic versions should immediately upgrade to the patched releases to prevent potential exploitation of this enumeration vulnerability that could compromise user account security through information disclosure attacks.