PT-2026-38302 · Statamic · Statamic

Published 2026-05-06 · Updated 2026-05-12 · CVE-2026-44306

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.73.21 Statamic versions prior to 6.15.0

Description Responses from the forgot password forms reveal whether an account exists for a specific email address. This allows an unauthenticated attacker to perform user enumeration, which can facilitate subsequent credential-based attacks.

Recommendations Update to version 5.73.21. Update to version 6.15.0.

Fix

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2026-44306

GHSA-M24V-F7G5-GQ67

Affected Products

Statamic

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-44306 · Security Note
• https://osv.dev/vulnerability/GHSA-m24v-f7g5-gq67 · Vendor Advisory
• https://github.com/statamic/cms · Note
• https://github.com/statamic/cms/security/advisories/GHSA-m24v-f7g5-gq67 · Note
• https://t.me/CVEtracker/53563 · Telegram Post
• https://twitter.com/CVEnew/status/2054323978609807770 · Twitter Post