CVE-2026-64664

{
  "id": "CVE-2026-64664",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-06T22:18:13.960",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view users, though the endpoint only exposed user existence and not any other user data. This issue is fixed in versions 5.74.1 and 6.24.0."
    },
    {
      "lang": "es",
      "value": "Statamic es un sistema de gestión de contenido (CMS) impulsado por Laravel y Git. Antes de las versiones 5.74.1 y 6.24.0, un usuario autenticado del Panel de Control podía usar un endpoint destinado al asistente de creación de usuarios para determinar si una dirección de correo electrónico dada pertenecía a un usuario existente, sin tener permiso para ver usuarios, aunque el endpoint solo exponía la existencia del usuario y no ningún otro dato del usuario. Este problema está solucionado en las versiones 5.74.1 y 6.24.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "statamic",
          "product": "cms",
          "versions": [
            {
              "version": ">= 6.0.0, < 6.24.0",
              "status": "affected"
            },
            {
              "version": "< 5.74.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-07T15:36:53.174987Z",
          "id": "CVE-2026-64664",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/statamic/cms/commit/aea68053cedab5c79d10102820b57345a7d7102e",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/statamic/cms/pull/14905",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/statamic/cms/releases/tag/v5.74.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/statamic/cms/releases/tag/v6.24.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/statamic/cms/security/advisories/GHSA-225x-3jhx-wh4q",
      "source": "[email protected]"
    }
  ]
}