CVE-2026-44306: Statamic CMS

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.21 and 6.15.0, responses from the forgot password forms hinted at whether an account existed for a given email address. An unauthenticated attacker could use this to enumerate valid users, which can aid in follow-up credential-based attacks. This vulnerability is fixed in 5.73.21 and 6.15.0.

Affected products

• Statamic CMS: before 5.73.21 (fixed in 5.73.21); from 6.0.0, before 6.15.0 (fixed in 6.15.0)

Published 2026-05-12. Last modified 2026-06-17.