CVE-2026-27593

Awaiting Analysis Awaiting Analysis - Queue

Password Reset Token Exposure in Statmatic CMS Enables Account Takeover

Publication date: 2026-02-24

Last updated on: 2026-02-25

Assigner: GitHub, Inc.

Description

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker must know the email address of a valid account on the site, and the actual user must blindly click the link in their email even though they didn't request the reset. This has been fixed in 6.3.3 and 5.73.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-24

Last Modified

2026-02-25

Generated

2026-07-06

AI Q&A

2026-02-25

EPSS Evaluated

2026-07-05

NVD

CVE-2026-27593

EUVD

EUVD-2026-8570

Affected Vendors & Products

Vendor	Product	Version / Range
statamic	statamic	to 5.73.10 (exc)
statamic	statamic	From 6.0.0 (inc) to 6.3.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-640	The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Statamic content management system's password reset feature prior to versions 6.3.3 and 5.73.10. An attacker who knows the email address of a valid user can exploit this flaw by causing the user to unknowingly click a malicious password reset link sent to their email. This allows the attacker to capture the user's password reset token and reset the user's password without their consent.

Impact Analysis

The vulnerability can lead to unauthorized account takeover since an attacker can reset a user's password and gain access to their account. This compromises the confidentiality and integrity of the user's data and potentially the entire system if the compromised account has elevated privileges.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Statamic to version 6.3.3 or later, or 5.73.10 or later, where the issue has been fixed.

Additionally, advise users to be cautious about clicking password reset links they did not request, as the attack requires the user to blindly click such a link.

Hi! I’m here to help you understand CVE-2026-27593. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70