CVE-2026-64665

{
  "id": "CVE-2026-64665",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-06T22:18:14.103",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, without knowing that user's password, because the application matched OAuth identities to accounts by email address alone. Exploitation requires OAuth to be explicitly enabled with such a provider. This issue is fixed in versions 5.74.1 and 6.24.0."
    },
    {
      "lang": "es",
      "value": "Statamic es un sistema de gestión de contenido (CMS) impulsado por Laravel y Git. Antes de las versiones 5.74.1 y 6.24.0, cuando el inicio de sesión OAuth estaba habilitado con un proveedor que no garantiza direcciones de correo electrónico verificadas, un atacante no autenticado podría iniciar sesión como un usuario existente, potencialmente incluyendo un superadministrador, sin conocer la contraseña de ese usuario, porque la aplicación emparejaba las identidades OAuth con las cuentas únicamente por la dirección de correo electrónico. La explotación requiere que OAuth esté explícitamente habilitado con dicho proveedor. Este problema está solucionado en las versiones 5.74.1 y 6.24.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "statamic",
          "product": "cms",
          "versions": [
            {
              "version": "< 5.74.1",
              "status": "affected"
            },
            {
              "version": ">= 6.0.0, < 6.24.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-07T15:26:57.594364Z",
          "id": "CVE-2026-64665",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        },
        {
          "lang": "en",
          "value": "CWE-290"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/statamic/cms/commit/e59dd342c83bc45de26573cfb0536a0bca98255a",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/statamic/cms/pull/14887",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/statamic/cms/releases/tag/v5.74.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/statamic/cms/releases/tag/v6.24.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/statamic/cms/security/advisories/GHSA-93qh-5269-9wcf",
      "source": "[email protected]"
    }
  ]
}