CVE-2026-27593
📋 TL;DR
This vulnerability in Statmatic CMS allows attackers to hijack password reset tokens and take over user accounts. Attackers need a valid email address and must trick users into clicking malicious reset links. All Statmatic installations below versions 6.3.3 and 5.73.10 are affected.
💻 Affected Systems
- Statmatic CMS
📦 What is this software?
Statamic by Statamic
Statamic by Statamic
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover of any user, including administrators, leading to data theft, privilege escalation, and full system compromise.
Likely Case
Targeted account takeover of specific users, potentially leading to unauthorized access to sensitive content or administrative functions.
If Mitigated
Limited impact with proper user awareness training and monitoring, though risk remains if users click malicious links.
🎯 Exploit Status
Exploitation requires social engineering to trick users into clicking malicious password reset links.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.3.3 or 5.73.10
Vendor Advisory: https://github.com/statamic/cms/releases/tag/v5.73.10
Restart Required: No
Instructions:
1. Backup your Statmatic installation. 2. Update to version 6.3.3 (if using v6) or 5.73.10 (if using v5). 3. Run 'composer update' if using Composer. 4. Clear Laravel cache with 'php artisan cache:clear'.
🔧 Temporary Workarounds
Disable password reset functionality
allTemporarily disable the password reset feature to prevent exploitation
Modify routes or middleware to block /password/reset endpoints
Implement rate limiting on reset requests
allAdd rate limiting to password reset endpoints to reduce attack surface
Configure Laravel rate limiting middleware for password reset routes
🧯 If You Can't Patch
- Implement multi-factor authentication for all user accounts
- Monitor logs for unusual password reset activity and alert on suspicious patterns
🔍 How to Verify
Check if Vulnerable:
Check Statmatic version in composer.json or via 'php artisan statamic:version' commandCheck Version:
php artisan statamic:versionVerify Fix Applied:
Confirm version is 6.3.3 or higher (for v6) or 5.73.10 or higher (for v5)📡 Detection & Monitoring
Log Indicators:
- Multiple password reset requests for same email from different IPs
- Password reset success logs for users who didn't request reset
Network Indicators:
- Unusual patterns of POST requests to /password/reset endpoints
SIEM Query:
source="web_logs" AND (uri_path="/password/reset" OR uri_path="/password/email") | stats count by src_ip, user_email🔗 References
- https://github.com/statamic/cms/commit/6fdd03324982848e8754f2edd2265262d361714e
- https://github.com/statamic/cms/commit/78e63dfcf705b116d5ac0f7f7f5a1a69be63d1be
- https://github.com/statamic/cms/commit/b2be592ddfb588bcb88c9be454f3590e14b145b0
- https://github.com/statamic/cms/releases/tag/v5.73.10
- https://github.com/statamic/cms/releases/tag/v6.3.3
- https://github.com/statamic/cms/security/advisories/GHSA-jxq9-79vj-rgvw
