CVE-2026-27593
Awaiting Analysis Awaiting Analysis - Queue
Password Reset Token Exposure in Statmatic CMS Enables Account Takeover

Publication date: 2026-02-24

Last updated on: 2026-02-25

Assigner: GitHub, Inc.

Description
Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker must know the email address of a valid account on the site, and the actual user must blindly click the link in their email even though they didn't request the reset. This has been fixed in 6.3.3 and 5.73.10.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-24
Last Modified
2026-02-25
Generated
2026-06-16
AI Q&A
2026-02-25
EPSS Evaluated
2026-06-15
NVD
CVE-2026-27593
EUVD
EUVD-2026-8570
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
statamic statamic to 5.73.10 (exc)
statamic statamic From 6.0.0 (inc) to 6.3.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-640 The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Statamic content management system's password reset feature prior to versions 6.3.3 and 5.73.10. An attacker who knows the email address of a valid user can exploit this flaw by causing the user to unknowingly click a malicious password reset link sent to their email. This allows the attacker to capture the user's password reset token and reset the user's password without their consent.

Impact Analysis

The vulnerability can lead to unauthorized account takeover since an attacker can reset a user's password and gain access to their account. This compromises the confidentiality and integrity of the user's data and potentially the entire system if the compromised account has elevated privileges.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Statamic to version 6.3.3 or later, or 5.73.10 or later, where the issue has been fixed.

Additionally, advise users to be cautious about clicking password reset links they did not request, as the attack requires the user to blindly click such a link.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-27593. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart