Security readout for executives and security teams
Plain-English summary
Statamic CMS exposed user email addresses to logged-in control panel users who lacked the “view users” permission. This is a privacy and data-minimization issue rather than a system takeover flaw. The vendor fixed it in versions 5.73.11 and 6.4.0.
Executive priority
Treat as a timely privacy fix. Prioritize systems with many control panel users, external contributors, or sensitive user directories. This does not appear to be an emergency remote compromise issue based on provided sources.
Technical view
CVE-2026-28424 is a missing authorization flaw, CWE-862, in Statamic CMS. Before 5.73.11 and in 6.x before 6.4.0, the user fieldtype data endpoint returned user email addresses to authenticated control panel users without the required permission. CVSS is 6.5: network reachable, low complexity, low privileges required, confidentiality impact high.
Likely exposure
Sites running Statamic CMS below 5.73.11, or 6.0.0 through below 6.4.0, are potentially affected if untrusted or lower-privileged users can access the control panel.
Exploitation context
The issue requires an authenticated control panel user. The available sources do not state public exploitation, and the CVE is not listed as KEV in the provided bundle. Impact is limited to unauthorized disclosure of user email addresses.
Researcher notes
Authorization checks around the user fieldtype data endpoint were insufficient. Validate only in owned environments and avoid collecting personal data. The public sources identify fixed versions but do not provide exploitation evidence or broader technical details.
Mitigation direction
- Upgrade Statamic 5.x installations to 5.73.11 or later.
- Upgrade Statamic 6.x installations to 6.4.0 or later.
- Review vendor advisory and release notes for environment-specific guidance.
- Limit control panel access to trusted users until patched.
Validation and detection
- Inventory Statamic CMS versions across production and staging.
- Confirm affected systems are upgraded to 5.73.11 or 6.4.0 or later.
- Review control panel accounts for unnecessary access.
- Check whether exposed email addresses require privacy incident review under internal policy.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-28424 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N2.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/statamic/cms/security/advisories/GHSA-w878-f8c6-7r63CVE reference · x_refsource_CONFIRM
- https://github.com/statamic/cms/releases/tag/v5.73.11CVE reference · x_refsource_MISC
- https://github.com/statamic/cms/releases/tag/v6.4.0CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.