Statamic CMS Email Enumeration Vulnerability in Password Reset Forms

A vulnerability in Statamic CMS versions prior to 5.73.21 and 6.15.0 allows for email enumeration through the forgot password forms. The responses from these forms inadvertently indicated whether an account was associated with a given email address. This behavior could be exploited by an unauthenticated attacker to identify valid users, potentially facilitating subsequent credential-based attacks.

Impact

Exploitation of this vulnerability could lead to user enumeration, allowing attackers to identify valid accounts for targeted credential-based attacks.

Remediation

Users can upgrade to Statamic CMS versions 5.73.21 or 6.15.0, where this vulnerability has been addressed. In the patched versions, the forgot password forms provide a consistent generic response, regardless of whether the submitted email corresponds to a registered user.