Statamic CMS has a missing authorization check on a Control Panel endpoint used during the user‑creation wizard. An authenticated user, even if not granted user‑management permissions, can invoke this endpoint to discover whether a specific email address is associated with an existing account. The endpoint returns only the existence flag, not any additional user data. The flaw is an information‑disclosure vulnerability (CWE‑200) compounded by an authorization oversight (CWE‑862).

The vulnerability affects Statamic CMS versions 5.x prior to 5.74.1 and 6.x prior to 6.24.0. Any installation of these versions that has the default Configuration for the Control Panel and is exposed to authenticated users is potentially exploitable until it is upgraded to a patched release.

The CVSS score of 4.3 indicates low to moderate severity. Exploitation requires that an attacker already has credentialed access to the Control Panel but lacks permission to view the user list; the attacker can then query the endpoint and learn whether specific email addresses are registered. No public exploit data is documented and the vulnerability is not listed in CISA KEV, so the threat is limited to enumeration that may aid social‑engineering attempts.