Statmatic is a Laravel and Git powered content management system (CMS).

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Feb 27, 2026 · NIST NVD

   Detected

   Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, user email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the "view users" permission. This has been fixed in 5.73.11 and 6.4.0.

2. Jun 17, 2026 · NIST NVD

   Updated

   Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, user email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the "view users" permission. This has been fixed in 5.73.11 and 6.4.0.

Affected

• cpe statamic/statamicversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-28424

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-28424

  Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, user email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the "view users" permission. This has been

  nvd.nist.gov

References

• Release Notes · github.com
• Release Notes · github.com
• Patch · github.com