CVE-2026-27593

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27593", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-20T19:43:14.601Z", "datePublished": "2026-02-24T21:38:17.354Z", "dateUpdated": "2026-02-27T20:56:07.561Z"}, "containers": {"cna": {"title": "Statamic is vulnerable to account takeover via password reset link injection", "problemTypes": [{"descriptions": [{"cweId": "CWE-640", "lang": "en", "description": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/statamic/cms/security/advisories/GHSA-jxq9-79vj-rgvw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/statamic/cms/security/advisories/GHSA-jxq9-79vj-rgvw"}, {"name": "https://github.com/statamic/cms/commit/6fdd03324982848e8754f2edd2265262d361714e", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/commit/6fdd03324982848e8754f2edd2265262d361714e"}, {"name": "https://github.com/statamic/cms/commit/78e63dfcf705b116d5ac0f7f7f5a1a69be63d1be", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/commit/78e63dfcf705b116d5ac0f7f7f5a1a69be63d1be"}, {"name": "https://github.com/statamic/cms/commit/b2be592ddfb588bcb88c9be454f3590e14b145b0", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/commit/b2be592ddfb588bcb88c9be454f3590e14b145b0"}, {"name": "https://github.com/statamic/cms/releases/tag/v5.73.10", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/releases/tag/v5.73.10"}, {"name": "https://github.com/statamic/cms/releases/tag/v6.3.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/releases/tag/v6.3.3"}], "affected": [{"vendor": "statamic", "product": "cms", "versions": [{"version": "< 5.73.10", "status": "affected"}, {"version": ">= 6.0.0-alpha.1, < 6.3.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-24T21:38:17.354Z"}, "descriptions": [{"lang": "en", "value": "Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker must know the email address of a valid account on the site, and the actual user must blindly click the link in their email even though they didn't request the reset. This has been fixed in 6.3.3 and 5.73.10."}], "source": {"advisory": "GHSA-jxq9-79vj-rgvw", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-27T20:55:56.535981Z", "id": "CVE-2026-27593", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T20:56:07.561Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27593", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-27T20:55:56.535981Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T20:56:03.345Z"}}], "cna": {"title": "Statamic is vulnerable to account takeover via password reset link injection", "source": {"advisory": "GHSA-jxq9-79vj-rgvw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "statamic", "product": "cms", "versions": [{"status": "affected", "version": "< 5.73.10"}, {"status": "affected", "version": ">= 6.0.0-alpha.1, < 6.3.3"}]}], "references": [{"url": "https://github.com/statamic/cms/security/advisories/GHSA-jxq9-79vj-rgvw", "name": "https://github.com/statamic/cms/security/advisories/GHSA-jxq9-79vj-rgvw", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/statamic/cms/commit/6fdd03324982848e8754f2edd2265262d361714e", "name": "https://github.com/statamic/cms/commit/6fdd03324982848e8754f2edd2265262d361714e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/statamic/cms/commit/78e63dfcf705b116d5ac0f7f7f5a1a69be63d1be", "name": "https://github.com/statamic/cms/commit/78e63dfcf705b116d5ac0f7f7f5a1a69be63d1be", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/statamic/cms/commit/b2be592ddfb588bcb88c9be454f3590e14b145b0", "name": "https://github.com/statamic/cms/commit/b2be592ddfb588bcb88c9be454f3590e14b145b0", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/statamic/cms/releases/tag/v5.73.10", "name": "https://github.com/statamic/cms/releases/tag/v5.73.10", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/statamic/cms/releases/tag/v6.3.3", "name": "https://github.com/statamic/cms/releases/tag/v6.3.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker must know the email address of a valid account on the site, and the actual user must blindly click the link in their email even though they didn't request the reset. This has been fixed in 6.3.3 and 5.73.10."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-640", "description": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-24T21:38:17.354Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27593", "state": "PUBLISHED", "dateUpdated": "2026-02-27T20:56:07.561Z", "dateReserved": "2026-02-20T19:43:14.601Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-24T21:38:17.354Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "cms", "vendor": "statamic", "versions": [{"status": "affected", "version": "< 5.73.10"}, {"status": "affected", "version": ">= 6.0.0-alpha.1, < 6.3.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:*", "matchCriteriaId": "09579639-615E-4F31-83CF-9A57F55D4B93", "versionEndExcluding": "5.73.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:*", "matchCriteriaId": "53E898A8-A303-4E91-B98A-5BC6C37F6AD1", "versionEndExcluding": "6.3.3", "versionStartIncluding": "6.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker must know the email address of a valid account on the site, and the actual user must blindly click the link in their email even though they didn't request the reset. This has been fixed in 6.3.3 and 5.73.10."}, {"lang": "es", "value": "Statmatic es un sistema de gesti\u00f3n de contenido (CMS) impulsado por Laravel y Git. Antes de las versiones 6.3.3 y 5.73.10, un atacante podr\u00eda aprovechar una vulnerabilidad en la funci\u00f3n de restablecimiento de contrase\u00f1a para capturar el token de un usuario y restablecer la contrase\u00f1a en su nombre. El atacante debe conocer la direcci\u00f3n de correo electr\u00f3nico de una cuenta v\u00e1lida en el sitio, y el usuario real debe hacer clic ciegamente en el enlace de su correo electr\u00f3nico aunque no haya solicitado el restablecimiento. Esto ha sido corregido en 6.3.3 y 5.73.10."}], "id": "CVE-2026-27593", "lastModified": "2026-06-17T10:27:21.573", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27593", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-27T20:55:56.535981Z", "version": "2.0.3"}}]}, "published": "2026-02-24T22:16:32.867", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/statamic/cms/commit/6fdd03324982848e8754f2edd2265262d361714e"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/statamic/cms/commit/78e63dfcf705b116d5ac0f7f7f5a1a69be63d1be"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/statamic/cms/commit/b2be592ddfb588bcb88c9be454f3590e14b145b0"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/statamic/cms/releases/tag/v5.73.10"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/statamic/cms/releases/tag/v6.3.3"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/statamic/cms/security/advisories/GHSA-jxq9-79vj-rgvw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-640"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.73.10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0.0-alpha.1,6.3.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "cms", "source": "cna", "vendor": "statamic"}, "product": "cms", "vendor": "statamic"}], "analysis": {"en": {"generated_at": "2026-04-16T16:20:13.413293+00:00", "value": {"mitigation_remediation": ["Apply the Statamic update to v6.3.3 or v5.73.10 or later to remove the password\u2011reset flaw.", "If an update cannot be performed immediately, temporarily disable the password reset endpoint or restrict reset requests to verified users.", "Implement or enforce multi\u2011factor authentication for all user accounts to reduce the risk of account takeover if a password is changed."], "summary": {"action": "Patch immediately", "impact": "Account takeover"}, "threat_synthesis": {"affected_systems": "Statamic CMS is affected. Versions earlier than 6.3.3 for the latest major release and earlier than 5.73.10 for the legacy release are vulnerable. All deployments of Statamic that have not applied these patches remain at risk.", "description_and_impact": "The vulnerability resides in Statamic's password\u2011reset feature. An attacker who knows a target user's e\u2011mail address can obtain the reset token and force a password change, enabling full account takeover without the user's knowledge. The flaw is classified as CWE\u2011640, reflecting impersonation through compromised credentials.", "risk_and_exploitability": "The CVSS score of 9.3 signals critical severity. Exploitation probability is currently very low, with an EPSS score below 1\u202f%. The vulnerability is not in the CISA KEV catalog. Exploitation requires the attacker to exploit the exposed password\u2011reset link; the user must receive and click the unfamiliar link, a classic click\u2011through scenario. Once the attacker supplies a valid e\u2011mail address, the reset token is captured and the password is overwritten, giving the attacker full control of the account."}}}}, "created": "2026-02-25T11:35:26.324503+00:00", "updated": "2026-04-16T16:30:15.927755+00:00", "vendors": ["statamic", "statamic$PRODUCT$cms"]}