CVE-2026-64664

mediumCVSS 4.3covered by 2 sourcesfirst seen 2026-08-06

Impact An authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belongs to an existing user, without having permission to view users. The endpoint only exposed user existence, not any of its data. Patches This has been fixed in 5.74.1 and 6.24.0.

⚡ Watch CVE-2026-64664

Get an email if CVE-2026-64664 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (2)

mediumCVE-2026-64664: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.2…nvd · 2026-08-06
mediumGHSA-225x-3jhx-wh4q: Statamic: Missing authorization on Control Panel endpoint allows disclosure of user exist…ghsa · 2026-08-06

External references

NVD record for CVE-2026-64664

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-64664 status](https://www.csirts.com/badge/CVE-2026-64664)](https://www.csirts.com/cve/CVE-2026-64664)