CVE-2020-9322 - The /users endpoint in Statamic Core before 2.11.8 allows XSS to add an administrator user

Back Back to CVE browser

HIGH

The /users endpoint in Statamic Core before 2.11.8 allows XSS to add an administrator user

Published Aug 8, 2025

8.8

HIGH

CVSS 3.1

EPSS 0.26%

Description

The /users endpoint in Statamic Core before 2.11.8 allows XSS to add an administrator user. This can be exploited via CSRF. Stored XSS can occur via a JavaScript payload in a username during account registration. Reflected XSS can occur via the /users PATH_INFO.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-352

CSRF

CWE-79

Cross-site Scripting (XSS)

References (4)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-30143		Advisory
https://gist.github.com/kernelsndrs/86b78e869d481566223914ec7d4fc881
https://statamic.com/changelog#2.11.18
https://web.archive.org/web/20200304174034/www.statamic.com/changelog#2.11.18