GitHub Advisoryadvisory · Packagist

GHSA-jxq9-79vj-rgvw Statamic is vulnerable to account takeover via password reset link injection

CRITICAL Published 2026-02-24 Modified 2026-03-19 Official page ↗
Aliases
CVE-2026-27593
Ecosystem
Packagist
Packages
statamic/cms
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-640
Reviewed
2026-02-24

Affected packages

• Packagist statamic/cms: < 5.73.10 → fixed in 5.73.10 • Packagist statamic/cms: >= 6.0.0-alpha.1, < 6.7.1 → fixed in 6.7.1

Description

Impact An attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker must know the email address of a valid account on the site, and the actual user must blindly click the link in their email even though they didn't request the reset. Patches This has been fixed in 6.7.1 and 5.73.10. Note that a follow-up report showed the original 6.3.3 fix to be insufficient. The 5.73.10 fix was sufficient.

Related

Alias · CVE (1)

  • CVE-2026-27593 Statmatic is a Laravel and Git powered content management system (CMS). vulnerability

Weakness · CWE (1)

  • CWE-640 Weak Password Recovery Mechanism for Forgotten Password weakness

References