CVE-2026-44306

{
  "id": "CVE-2026-44306",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-12T22:16:37.413",
  "lastModified": "2026-10-26T14:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.21 and 6.15.0, responses from the forgot password forms hinted at whether an account existed for a given email address. An unauthenticated attacker could use this to enumerate valid users, which can aid in follow-up credential-based attacks. This vulnerability is fixed in 5.73.21 and 6.15.0."
    },
    {
      "lang": "es",
      "value": "Statamic es un sistema de gestión de contenidos (CMS) impulsado por Laravel y Git. Antes de las versiones 5.73.21 y 6.15.0, las respuestas de los formularios de ’olvidé mi contraseña’ insinuaban si existía una cuenta para una dirección de correo electrónico determinada. Un atacante no autenticado podría usar esto para enumerar usuarios válidos, lo que puede ayudar en ataques posteriores basados en credenciales. Esta vulnerabilidad está corregida en las versiones 5.73.21 y 6.15.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "statamic",
          "product": "cms",
          "versions": [
            {
              "version": "< 5.73.21",
              "status": "affected"
            },
            {
              "version": ">= 6.0.0, < 6.15.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-13T18:15:50.669186Z",
          "id": "CVE-2026-44306",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-204"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/statamic/cms/security/advisories/GHSA-m24v-f7g5-gq67",
      "source": "[email protected]"
    }
  ]
}