Open-source package vulnerability · Composer (PHP)

CVE-2026-27593: Statamic is vulnerable to account takeover via password reset link injection

criticalCVSS 3.1 9.3GHSA-jxq9-79vj-rgvw

Impact An attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker must know the email address of a valid account on the site, and the actual user must blindly click the link in their email even though they didn't request the reset. Patches This has been fixed in 6.7.1 and 5.73.10.

Published Feb 24, 2026 · Updated Mar 19, 2026

Affected packages

statamic/cms

Ecosystem: Composer (PHP)
Affected: < 5.73.10
Fixed in: 5.73.10
Check: composer show statamic/cms

statamic/cms

Ecosystem: Composer (PHP)
Affected: >= 6.0.0-alpha.1, < 6.7.1
Fixed in: 6.7.1
Check: composer show statamic/cms

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

An attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf.

The attacker must know the email address of a valid account on the site, and the actual user must blindly click the link in their email even though they didn't request the reset.

Patches

This has been fixed in 6.7.1 and 5.73.10.

Note that a follow-up report showed the original 6.3.3 fix to be insufficient. The 5.73.10 fix was sufficient.

Credited to Neosprings, everythingBlackkk.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology