CVE-2026-27593

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker must know the email address of a valid account on the site, and the actual user must blindly click the link in their email even though they didn't request the reset. This has been fixed in 6.3.3 and 5.73.10.

• CWE-640

• https://github.com/statamic/cms/commit/6fdd03324982848e8754f2edd2265262d361714ePatch
• https://github.com/statamic/cms/commit/78e63dfcf705b116d5ac0f7f7f5a1a69be63d1bePatch
• https://github.com/statamic/cms/commit/b2be592ddfb588bcb88c9be454f3590e14b145b0Patch
• https://github.com/statamic/cms/releases/tag/v5.73.10Release Notes
• https://github.com/statamic/cms/releases/tag/v6.3.3Release Notes
• https://github.com/statamic/cms/security/advisories/GHSA-jxq9-79vj-rgvwVendor Advisory

Published

Feb 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27587Caddy is an extensible server platform that uses TLS by defa…9.1
• CVE-2026-27588Caddy is an extensible server platform that uses TLS by defa…9.1
• CVE-2026-27589Caddy is an extensible server platform that uses TLS by defa…6.5
• CVE-2026-2759Incorrect boundary conditions in the Graphics: ImageLib comp…9.8
• CVE-2026-27590Caddy is an extensible server platform that uses TLS by defa…9.8
• CVE-2026-27591Winter is a free, open-source content management system (CMS…9.9
• CVE-2026-27595Parse Dashboard is a standalone dashboard for managing Parse…7.5
• CVE-2026-27596Exiv2 is a C++ library and a command-line utility to read, w…7.5
• CVE-2026-27597Enclave is a secure JavaScript sandbox designed for safe AI …10
• CVE-2026-27598Dagu is a workflow engine with a built-in Web user interface…6.5
• CVE-2026-27599CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a …7.2
• CVE-2026-2760Sandbox escape due to incorrect boundary conditions in the G…10