The vulnerability occurs when the forgotten‑password endpoints return different responses based on whether the supplied email address belongs to a registered user. This information disclosure allows an unauthenticated attacker to enumerate valid accounts, which can then be targeted with credential‑based attacks. The flaw falls under CWE‑204.

Affected releases belong to the Statamic content‑management system. Versions earlier than 5.73.21 and 6.15.0 are impacted because they exposed the existence of accounts through the password‑reset workflow. All other Statamic versions are unaffected.

The CVSS score of 5.3 indicates a moderate risk. The EPSS is not available, and the vulnerability is not listed in CISA KEV, suggesting limited exploitation data. An attacker would simply send unauthenticated HTTP requests to the forgot‑password endpoint and parse the differing responses. No authentication or privileged access is required to perform the enumeration.