CyberRota Analysis
AI-GeneratedAuthenticated users of Statamic prior to versions 5.74.1 and 6.24.0 can exploit a vulnerability in the user creation wizard endpoint to verify the existence of email addresses associated with existing users, potentially leading to user enumeration. While this does not expose additional user data, it could aid attackers in targeting specific accounts. Organizations using affected versions should prioritize upgrading to the latest releases to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view users, though the endpoint only exposed user existence and not any other user data. This issue is fixed in versions 5.74.1 and 6.24.0.