CVE-2026-27593
Password Reset Token Exposure in Statmatic CMS Enables Account Takeover
Publication date: 2026-02-24
Last updated on: 2026-02-25
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| statamic | statamic | to 5.73.10 (exc) |
| statamic | statamic | From 6.0.0 (inc) to 6.3.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-640 | The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Statamic content management system's password reset feature prior to versions 6.3.3 and 5.73.10. An attacker who knows the email address of a valid user can exploit this flaw by causing the user to unknowingly click a malicious password reset link sent to their email. This allows the attacker to capture the user's password reset token and reset the user's password without their consent.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized account takeover since an attacker can reset a user's password and gain access to their account. This compromises the confidentiality and integrity of the user's data and potentially the entire system if the compromised account has elevated privileges.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Statamic to version 6.3.3 or later, or 5.73.10 or later, where the issue has been fixed.
Additionally, advise users to be cautious about clicking password reset links they did not request, as the attack requires the user to blindly click such a link.