CVE-2026-64662 Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from entries they did not have permission to view, including entry content and custom field values, from any collection and including unpublished...

CVE-2026-64662 Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from entries they did not have permission to view, including entry content and custom field values, from any collection and including unpublished...

GHSA-225X-3JHX-WH4Q Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence

Impact An authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belongs to an existing user, without having permission to view users. The endpoint only exposed user existence, not any of its data. Patches This has been...

Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence

Impact An authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belongs to an existing user, without having permission to view users. The endpoint only exposed user existence, not any of its data. Patches This has been...

CVE-2026-64664 Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view...

EUVD-2026-54231

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view...

CVE-2026-64664

Statamic CMS (Laravel/Git) contains a privacy-related flaw fixed in 5.74.1 and 6.24.0. Before these versions, an authenticated Control Panel user could call the endpoint intended for the user creation wizard to determine whether a given email exists in the system, even without permission to view ...

CVE-2026-64664

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view...

CVE-2026-64664 Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view...

CVE-2026-64664 Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view...

PT-2026-70178

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.18.1 Craft CMS versions 5.0.0-RC1 through 5.10.5 Description An authenticated remote code execution issue exists in the control panel element-search condition handling. The software uses...

EUVD-2026-51573

Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context...

CVE-2026-25424

Contributor Broken Access Control in Mediavine Control Panel = 2.10.10 versions...

CVE-2026-25424 WordPress Mediavine Control Panel plugin <= 2.10.10 - Broken Access Control vulnerability

Contributor Broken Access Control in Mediavine Control Panel = 2.10.10 versions...

EUVD-2026-48148

Contributor Broken Access Control in Mediavine Control Panel = 2.10.10 versions...

CVE-2026-25424

CVE-2026-25424 concerns the WordPress Mediavine Control Panel plugin, affected in versions

CVE-2026-25424 WordPress Mediavine Control Panel plugin <= 2.10.10 - Broken Access Control vulnerability

Contributor Broken Access Control in Mediavine Control Panel = 2.10.10 versions...

PT-2026-63806

Contributor Broken Access Control in Mediavine Control Panel = 2.10.10 versions...

CVE-2026-25424: Missing Authorization

Contributor Broken Access Control in Mediavine Control Panel = 2.10.10 versions...

WordPress Mediavine Control Panel plugin <= 2.10.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Mediavine Control Panel versions = 2.10.10...