CVE-2026-44306 Statamic: Email enumeration via forgot password endpoint
An unauthenticated attacker can enumerate valid user accounts via the forgot password endpoint, aiding credential attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44306?
CVE-2026-44306 is a medium-severity vulnerability in statamic cms, published on 12 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.21 and 6.15.0, responses from the forgot password forms hinted at whether an account existed for a given email address. An unauthenticated attacker could use this to enumerate valid users, which can aid in follow-up credential-based attacks. This vulnerability is fixed in 5.73.21 and 6.15.0.
Weakness: CWE-204
Which versions are affected by CVE-2026-44306?
4 open source packages ship an affected version, including statamic/cms.
| Package | Affected | Fixed in |
|---|---|---|
statamic/cms Packagist | All versions | 5.73.21 |
statamic/cms Packagist | All versions | 5.73.21 |
statamic/cms Packagist | From 6.0.0 | 6.15.0 |
statamic/cms Packagist | From 6.0.0 | 6.15.0 |
How do I fix CVE-2026-44306?
Upgrade statamic/cms to a fixed version for your release line: 5.73.21 or 6.15.0.
Is CVE-2026-44306 being exploited?
There is no known exploitation of CVE-2026-44306 in the wild and no public exploit code.
Sources
Also known as GHSA-m24v-f7g5-gq67.