PT-2026-22423 · Statmatic · Statmatic

Jasonvarga · Published 2026-02-27 · Updated 2026-03-05 · CVE-2026-28424

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Statmatic versions prior to 5.73.11 Statmatic versions prior to 6.4.0

Description Statmatic is a Laravel and Git powered content management system (CMS). Before versions 5.73.11 and 6.4.0, user email addresses were included in responses from the user fieldtype’s data endpoint for control panel users lacking the "view users" permission. The data endpoint is accessed via the /user API endpoint. The vulnerable parameter is the user's email address.

Recommendations Update to version 5.73.11 or later. Update to version 6.4.0 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-28424

GHSA-W878-F8C6-7R63

Affected Products

Statmatic

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28424.json · Exploit
• https://github.com/statamic/cms/security/advisories/GHSA-w878-f8c6-7r63 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28424 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28424 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w878-f8c6-7r63 · Vendor Advisory
• https://github.com/statamic/cms · Note
• https://github.com/statamic/cms/releases/tag/v5.73.11 · Note
• https://github.com/statamic/cms/releases/tag/v6.4.0 · Note
• https://t.me/cveNotify/154331 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2027554058769252851 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1rj3cki/resumen_diario_de_vulnerabilidades_02032026 · Reddit Post
• https://twitter.com/CVEnew/status/2027744210720350576 · Twitter Post
• https://t.me/CVEtracker/46014 · Telegram Post