Statamic’s markdown preview endpoint allows an attacker who is authenticated to the control panel to manipulate the request and receive data from arbitrary fieldtypes. The users fieldtype can expose email addresses, encrypted passkey data and encrypted two‑factor authentication codes. This vulnerability enables disclosure of sensitive user information, constituting an information‑exposure flaw.

Statamic CMS versions earlier than 5.73.16 and 6.7.2 are affected. The flaw exists in the markdown preview endpoint that is part of the core CMS, and it is exploitable by any user with control‑panel access.

The vulnerability carries a CVSS score of 6.5, indicating moderate severity. The EPSS rating is below 1 %, showing a low probability that it is currently being exploited in the wild. It is also not listed in CISA’s KEV catalog, confirming that no known exploits are active. The attack vector is likely an authenticated user within the CMS control panel; therefore accidental exposure requires legitimate credentials, but if an attacker gains such access, they can immediately pull user data from the preview endpoint without any further privileges.