Log in Start free

Vulnerability · Published Feb 24, 2026 · Assigned by GitHub_M

CVE-2026-27593Statamic is vulnerable to account takeover via password reset link injection

Critical 9.3

In plain English

A critical-severity security flaw in cms from statamic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.3Critical
Exploit odds (30 days)0.5%top 55.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker must know the email address of a valid account on the site, and the actual user must blindly click the link in their email even though they didn't request the reset. This has been fixed in 6.3.3 and 5.73.10.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagiststatamic/cms5.73.10GHSA-jxq9-79vj-rgvw
Packagiststatamic/cms6.7.1GHSA-jxq9-79vj-rgvw

Affected products (as reported)

VendorProductVersions
statamic cms < 5.73.10>= 6.0.0-alpha.1, < 6.3.3

Weakness: CWE-640 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

References