6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28424

CVE-2026-28424: Statamic's missing authorization allows access to email addresses

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, user email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the "view users" permission. This has been fixed in 5.73.11 and 6.4.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28424

CVE-2026-28424:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
statamic/cms	composer	< 5.73.11	5.73.11
statamic/cms	composer	>= 6.0.0-alpha.1, < 6.4.0	6.4.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the Statamic CMS user fieldtype, which allowed a control panel user without 'view users' permissions to access the email addresses of other users. The root cause is a lack of authorization checks in the API endpoint that serves data to the user fieldtype component.

The analysis of the security patches reveals several key functions:

Statamic\Fieldtypes\Users->getIndexItems(): This function is responsible for fetching and formatting the list of users displayed in the user fieldtype selector. The patch e70af0f32875e56937e637e936decae12107a585 introduces a permission check ($this->canViewUsers()) to conditionally include the email field in the returned data. Additionally, patch 6dd8a21625382dcf05d9371498382213f767f52d wraps the email search logic in the same permission check, preventing users from inferring emails via search queries. This indicates the function was a primary source of the information leak.
Statamic\Fieldtypes\Users->toItemArray(): This function prepares the data for a single selected user. The patch e70af0f32875e56937e637e936decae12107a585 replaces a direct call to $user->name() with a new helper method, $this->userTitle(). This new method contains logic to only show the email as a fallback to the name if the current user has the appropriate permissions; otherwise, it shows the user ID. This change directly addresses the information disclosure.
Statamic\Auth\User->name(): This model-level function was modified in patch 49cc2069bd5dbc69a16ffcf2bf785e4fe58f4fd2 to stop falling back to the user's email address if the name field was empty. While not a security control itself, its previous behavior contributed to the vulnerability by causing any part of the UI that displayed a user's "name" to potentially leak their email address.

During exploitation, a malicious but authenticated low-privileged user would make a request to the user fieldtype's data endpoint. This would trigger a call to Statamic\Fieldtypes\Users->getIndexItems(), which, prior to the patch, would return a JSON response containing the names and email addresses of all users.

Vulnerable functions

Statamic\Fieldtypes\Users->getIndexItems

src/Fieldtypes/Users.php

This function is responsible for fetching the list of users for the user fieldtype's data endpoint. Before the patch, it returned user email addresses for all users, regardless of whether the requesting user had permissions to view them. The patch adds a permission check to only include the 'email' field for authorized users.

Statamic\Fieldtypes\Users->toItemArray

src/Fieldtypes/Users.php

This function processes a single user record for the fieldtype. It was vulnerable because it used the `User->name()` method, which could fall back to the email address. The function did not perform any permission checks. The patch fixes this by calling a new `userTitle` helper method that respects permissions before returning user data.

Statamic\Auth\User->name

src/Auth/User.php

This function previously returned the user's email address if their name was not set. This behavior contributed to the vulnerability by causing other functions, such as `toItemArray`, to inadvertently expose email addresses when they intended to display only a name. The patch changes this behavior to return null, preventing the unintended leak.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.