Statamic's missing authorization allows access to email addresses

Vulnerability

Overview

CVE-2026-28424 describes an information disclosure vulnerability in Statmatic, a Laravel and Git powered CMS. The user fieldtype's data endpoint failed to properly enforce the "view users" permission, causing it to include user email addresses in responses even for control panel users who lacked that permission [1][4]. This missing authorization check allowed unauthorized access to sensitive user information.

Exploitation

An authenticated control panel user without the "view users" permission could query the user fieldtype data endpoint and receive email addresses of other users. The attack requires only a valid control panel session and does not require any special privileges beyond basic access [4]. The endpoint did not verify whether the requesting user had the necessary permission to view user details.

Impact

Successful exploitation leads to the exposure of user email addresses, which can be used for targeted phishing or social engineering attacks. While the vulnerability does not allow modification of data or privilege escalation, the confidentiality impact is significant as email addresses are considered private information [1][4].

Mitigation

The issue has been addressed in Statmatic versions 5.73.11 and 6.4.0. The fix ensures that the user fieldtype data endpoint respects the "view users" permission and only returns email addresses to authorized users [2][4]. Users are strongly advised to upgrade to the latest patched version to protect against this vulnerability.