We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2026-28424

CVE-2026-28424

Laravel

Severity: MEDIUM
CVSS: 6.5CVSS
Published: 2026-02-27
Last modified: 2026-03-05
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE: CWE-862

Description

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, user email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the "view users" permission. This has been fixed in 5.73.11 and 6.4.0.

References

https://github.com/statamic/cms/releases/tag/v5.73.11
https://github.com/statamic/cms/releases/tag/v6.4.0
https://github.com/statamic/cms/security/advisories/GHSA-w878-f8c6-7r63

Summary

Description

References