CVE-2026-27593
Published: 24 February 2026
Summary
CVE-2026-27593 is a critical-severity Weak Password Recovery Mechanism for Forgotten Password (CWE-640) vulnerability in Statamic Statamic. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 IA-5 (Authenticator Management) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-27593 affects Statamic, a Laravel and Git-powered content management system (CMS), specifically in its password reset feature. In versions prior to 6.3.3 and 5.73.10, an attacker can capture a user's password reset token and use it to reset the password on the victim's behalf. The issue stems from improper handling in the reset process and is mapped to CWE-640 (Weak Password Recovery Mechanism for Forgotten Identity), with a CVSS v3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), indicating high severity due to network accessibility, low complexity, no required privileges, user interaction, changed scope, and high impact on confidentiality and integrity.
A remote, unauthenticated attacker can exploit this vulnerability by knowing the email address of a valid account on the affected Statamic site. The attacker triggers or leverages the reset mechanism to obtain a token, which is delivered via email to the victim. If the legitimate user blindly clicks the link in this unsolicited email—without verifying the request—the attacker can then use the activated token to complete the password reset, gaining full unauthorized access to the account.
Mitigation is provided through patches in Statamic versions 6.3.3 and 5.73.10, as detailed in the project's GitHub releases and associated fix commits. Security practitioners should prioritize upgrading affected installations to these versions to prevent exploitation.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8570
Vulnerability details
Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf.…
more
The attacker must know the email address of a valid account on the site, and the actual user must blindly click the link in their email even though they didn't request the reset. This has been fixed in 6.3.3 and 5.73.10.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing Statamic CMS password reset (CWE-640) directly enables remote exploitation of the web app (T1190) to perform unauthorized account manipulation via password reset (T1098) and obtain access to valid user accounts (T1078).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by requiring timely patching of the vulnerable password reset feature in Statamic versions prior to 6.3.3 and 5.73.10.
Ensures secure lifecycle management of password reset tokens as authenticators, preventing attackers from capturing and exploiting them to reset victim passwords.
Generates audit records for password reset events, enabling detection of unauthorized token usage and account takeovers.