Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-nsp1-qqp9-g3g9
Vulnerability ID VCID-nsp1-qqp9-g3g9
Aliases CVE-2026-27593
GHSA-jxq9-79vj-rgvw
Summary Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker must know the email address of a valid account on the site, and the actual user must blindly click the link in their email even though they didn't request the reset. This has been fixed in 6.3.3 and 5.73.10.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-640 Weak Password Recovery Mechanism for Forgotten Password
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2026-27593
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2026-27593
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2026-27593
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-jxq9-79vj-rgvw
cvssv3.1 9.3 https://github.com/statamic/cms
generic_textual CRITICAL https://github.com/statamic/cms
cvssv3.1 9.3 https://github.com/statamic/cms/commit/6fdd03324982848e8754f2edd2265262d361714e
generic_textual CRITICAL https://github.com/statamic/cms/commit/6fdd03324982848e8754f2edd2265262d361714e
ssvc Track https://github.com/statamic/cms/commit/6fdd03324982848e8754f2edd2265262d361714e
cvssv3.1 9.3 https://github.com/statamic/cms/commit/78e63dfcf705b116d5ac0f7f7f5a1a69be63d1be
generic_textual CRITICAL https://github.com/statamic/cms/commit/78e63dfcf705b116d5ac0f7f7f5a1a69be63d1be
ssvc Track https://github.com/statamic/cms/commit/78e63dfcf705b116d5ac0f7f7f5a1a69be63d1be
cvssv3.1 9.3 https://github.com/statamic/cms/commit/b2be592ddfb588bcb88c9be454f3590e14b145b0
generic_textual CRITICAL https://github.com/statamic/cms/commit/b2be592ddfb588bcb88c9be454f3590e14b145b0
ssvc Track https://github.com/statamic/cms/commit/b2be592ddfb588bcb88c9be454f3590e14b145b0
cvssv3.1 9.3 https://github.com/statamic/cms/releases/tag/v5.73.10
generic_textual CRITICAL https://github.com/statamic/cms/releases/tag/v5.73.10
ssvc Track https://github.com/statamic/cms/releases/tag/v5.73.10
cvssv3.1 9.3 https://github.com/statamic/cms/releases/tag/v6.3.3
generic_textual CRITICAL https://github.com/statamic/cms/releases/tag/v6.3.3
ssvc Track https://github.com/statamic/cms/releases/tag/v6.3.3
cvssv3.1 9.3 https://github.com/statamic/cms/security/advisories/GHSA-jxq9-79vj-rgvw
cvssv3.1_qr CRITICAL https://github.com/statamic/cms/security/advisories/GHSA-jxq9-79vj-rgvw
generic_textual CRITICAL https://github.com/statamic/cms/security/advisories/GHSA-jxq9-79vj-rgvw
ssvc Track https://github.com/statamic/cms/security/advisories/GHSA-jxq9-79vj-rgvw
cvssv3.1 9.3 https://nvd.nist.gov/vuln/detail/CVE-2026-27593
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2026-27593
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-27593
https://github.com/statamic/cms
6fdd03324982848e8754f2edd2265262d361714e https://github.com/statamic/cms/commit/6fdd03324982848e8754f2edd2265262d361714e
78e63dfcf705b116d5ac0f7f7f5a1a69be63d1be https://github.com/statamic/cms/commit/78e63dfcf705b116d5ac0f7f7f5a1a69be63d1be
b2be592ddfb588bcb88c9be454f3590e14b145b0 https://github.com/statamic/cms/commit/b2be592ddfb588bcb88c9be454f3590e14b145b0
CVE-2026-27593 https://nvd.nist.gov/vuln/detail/CVE-2026-27593
GHSA-jxq9-79vj-rgvw https://github.com/advisories/GHSA-jxq9-79vj-rgvw
GHSA-jxq9-79vj-rgvw https://github.com/statamic/cms/security/advisories/GHSA-jxq9-79vj-rgvw
v5.73.10 https://github.com/statamic/cms/releases/tag/v5.73.10
v6.3.3 https://github.com/statamic/cms/releases/tag/v6.3.3
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Found at https://github.com/statamic/cms
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Found at https://github.com/statamic/cms/commit/6fdd03324982848e8754f2edd2265262d361714e
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-27T20:55:56Z/ Found at https://github.com/statamic/cms/commit/6fdd03324982848e8754f2edd2265262d361714e
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Found at https://github.com/statamic/cms/commit/78e63dfcf705b116d5ac0f7f7f5a1a69be63d1be
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-27T20:55:56Z/ Found at https://github.com/statamic/cms/commit/78e63dfcf705b116d5ac0f7f7f5a1a69be63d1be
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Found at https://github.com/statamic/cms/commit/b2be592ddfb588bcb88c9be454f3590e14b145b0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-27T20:55:56Z/ Found at https://github.com/statamic/cms/commit/b2be592ddfb588bcb88c9be454f3590e14b145b0
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Found at https://github.com/statamic/cms/releases/tag/v5.73.10
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-27T20:55:56Z/ Found at https://github.com/statamic/cms/releases/tag/v5.73.10
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Found at https://github.com/statamic/cms/releases/tag/v6.3.3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-27T20:55:56Z/ Found at https://github.com/statamic/cms/releases/tag/v6.3.3
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Found at https://github.com/statamic/cms/security/advisories/GHSA-jxq9-79vj-rgvw
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-27T20:55:56Z/ Found at https://github.com/statamic/cms/security/advisories/GHSA-jxq9-79vj-rgvw
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-27593
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.04353
EPSS Score 0.00017
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:50:56.701164+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/27xxx/CVE-2026-27593.json 38.6.0