Statamic CMS CVE-2026-44306
MEDIUM
GHSA-m24v-f7g5-gq67
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Impact
Responses from the forgot password forms hinted at whether an account existed for a given email address. An unauthenticated attacker could use this to enumerate valid users, which can aid in follow-up credential-based attacks.
Patches
This has been fixed in 5.73.21 and 6.15.0. The forgot password forms now return the same generic response regardless of whether the submitted email matches a registered user.
AnalysisAI
Statamic CMS versions before 5.73.21 and 6.0-6.14.x disclose whether an email address is registered via differential responses from the forgot password endpoint, enabling unauthenticated attackers to enumerate valid user accounts and facilitate downstream credential-based attacks. The vulnerability has a CVSS score of 5.3 (low confidentiality impact) and no public exploit code or active exploitation has been identified.
Technical ContextAI
The vulnerability stems from CWE-204 (Observable Discrepancy), a classic information disclosure pattern where the application leaks data through differences in HTTP response behavior. The forgot password form in Statamic CMS (pkg:composer/statamic/cms) returns distinct response messages or status codes depending on whether the submitted email matches a registered user account. This allows enumeration without authentication, as the endpoint is accessible over the network (AV:N) with no special complexity or privileges required (AC:L, PR:N). The root cause is insufficient response normalization - the application should return identical generic messages (e.g., 'If an account exists, we will send a reset link') regardless of account existence.
RemediationAI
Upgrade Statamic CMS to version 5.73.21 or 6.15.0 or later. No workarounds are available short of patching, as the issue is inherent to the forgot password response logic. If immediate patching is not feasible, apply rate limiting and CAPTCHA to the forgot password endpoint to increase enumeration friction and cost, though this does not eliminate the disclosure. Verify the upgrade via Composer and test the forgot password flow to confirm identical responses for both valid and invalid email addresses before returning the instance to production.
Same weakness CWE-204 – Observable Response Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today