https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T14:12:43.423486+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-273956 EUVD-2026-273956 2026-10-07T14:12:43.477515+00:00 EUVD-2026-273956 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28424 fkie_cve-2026-28424 2026-10-07T14:12:43.477558+00:00

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, user email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the "view users" permission. This has been fixed in 5.73.11 and 6.4.0.

 https://cve.radiocsirt.org/vuln/ghsa-w878-f8c6-7r63 GHSA-w878-f8c6-7r63 — Statamic's missing authorization allows access to email addresses 2026-10-07T14:12:43.477597+00:00

Affected: Packagist: statamic/cms

### Impact User email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the “view users” permission.

### Patches This has been fixed in 5.73.11 and 6.4.0.