CVE-2026-27593 Statamic is vulnerable to account takeover via password reset link injection
Attackers can hijack user accounts by injecting password reset links, requiring the victim to click an unsolicited email link.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-27593?
CVE-2026-27593 is a critical authentication bypass vulnerability in statamic cms, published on 24 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker must know the email address of a valid account on the site, and the actual user must blindly click the link in their email even though they didn't request the reset. This has been fixed in 6.3.3 and 5.73.10.
Weakness: CWE-640
Which versions are affected by CVE-2026-27593?
4 open source packages ship an affected version, including statamic/cms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
statamic/cms Packagist | All versions | 5.73.10 |
statamic/cms Packagist | All versions | 5.73.10 |
statamic/cms Packagist | From 6.0.0-alpha.1 | 6.7.1 |
statamic/cms Packagist | From 6.0.0-alpha.1 | 6.7.1 |
Products include Statamic Statamic.
How do I fix CVE-2026-27593?
Upgrade statamic/cms to a fixed version for your release line: 5.73.10 or 6.7.1.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-27593 being exploited?
There is no known exploitation of CVE-2026-27593 in the wild and no public exploit code.
Other vulnerabilities in statamic cms
- CVE-2021-45364 Code injection in n/a
- CVE-2026-27939 Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass
- CVE-2023-48217 Remote code execution via form uploads in statamic/cms
- CVE-2017-11422 Statamic framework Incorrect Permission Assignment
- CVE-2026-33172 Statamic has Stored XSS via SVG Sanitization Bypass
Sources
Also known as GHSA-jxq9-79vj-rgvw.