CVE-2026-28424: 
PHP vulnerability analysis and mitigation

CVE-2026-28424 is a missing authorization vulnerability in Statamic CMS (a Laravel and Git-powered content management system) that allows authenticated low-privileged control panel users to access user email addresses they are not permitted to view. The flaw exists in the user fieldtype's data endpoint, which incorrectly included email addresses in responses regardless of whether the requesting user held the "view users" permission. It affects all Statamic versions prior to 5.73.11 (5.x branch) and versions 6.0.0 through 6.4.0 (6.x branch). Disclosed on February 27, 2026, it carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, Statamic Advisory).

The root cause is classified as CWE-862 (Missing Authorization): the user fieldtype's data endpoint failed to enforce the "view users" permission check before including email addresses in its API responses. An authenticated attacker with any level of control panel access — even without the "view users" permission — could query this endpoint over the network to retrieve email addresses of all users registered in the Statamic instance. No complex attack chain or user interaction is required; the only precondition is possession of valid (low-privilege) control panel credentials (Github Advisory, Statamic Advisory).

Successful exploitation results in unauthorized disclosure of user email addresses, representing a high confidentiality impact with no effect on integrity or availability. An attacker who harvests these email addresses could use them to conduct targeted phishing campaigns, social engineering attacks, or credential stuffing attempts against affected users. While the vulnerability does not directly enable lateral movement or system compromise, the exposed contact information can serve as a stepping stone for further attacks against the Statamic instance's user base (Github Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is approximately 0.042% (13th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access to the Statamic control panel, which limits the attacker pool but does not eliminate risk in multi-tenant or shared-access deployments (Github Advisory).

1. Obtain control panel access: Acquire any valid low-privilege Statamic control panel account (e.g., an editor or contributor role without the "view users" permission).
2. Identify the user fieldtype data endpoint: Locate the API endpoint used by the user fieldtype to fetch user data within the Statamic control panel (typically accessible via the CMS's internal REST-like API routes).
3. Send authenticated request: Issue an authenticated HTTP GET request to the user fieldtype's data endpoint using the low-privilege session token or credentials.
4. Harvest email addresses: Parse the JSON response, which incorrectly includes user email addresses despite the requesting account lacking the "view users" permission.
5. Leverage harvested data: Use the collected email addresses for phishing, social engineering, or credential stuffing attacks against the Statamic instance's users (Github Advisory).

• Logs: Statamic/Laravel access logs showing repeated or unusual GET requests to the user fieldtype data endpoint from accounts that do not hold the "view users" permission; look for low-privilege user sessions querying user-related API routes.
• Network: Unexpected API calls to internal Statamic user fieldtype endpoints originating from authenticated sessions with limited roles, particularly if accessed in bulk or at unusual hours.
• Application Logs: Laravel application logs recording access to user data endpoints by accounts without appropriate permissions, which may surface as anomalous authorization events if logging is verbose.

Statamic has released patched versions addressing this vulnerability: 5.73.11 for the 5.x branch and 6.4.0 for the 6.x branch. Users should upgrade immediately to one of these versions. No configuration-based workaround is available; upgrading is the only remediation. As a supplementary measure, administrators should audit control panel user permissions to ensure the principle of least privilege is applied, and review access logs to determine whether the vulnerable endpoint was queried by low-privileged users prior to patching (Statamic Advisory, v5.73.11 Release, v6.4.0 Release).