VDB
KO
MEDIUM 4.3

GHSA-225x-3jhx-wh4q

Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence

Quick fix

GHSA-225x-3jhx-wh4q — statamic/cms: upgrade to the fixed version with the command below. 

composer require statamic/cms:^5.74.1

Details

### Impact An authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belongs to an existing user, without having permission to view users.

The endpoint only exposed user existence, not any of its data.

### Patches This has been fixed in 5.74.1 and 6.24.0.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist / statamic/cms
Introduced in: 0 Fixed in: 5.74.1
Fix composer require statamic/cms:^5.74.1
Packagist / statamic/cms
Introduced in: 6.0.0 Fixed in: 6.24.0
Fix composer require statamic/cms:^6.24.0

References