PT-2026-21809 · Statmatic · Statmatic

Neosprings · Published 2026-02-24 · Updated 2026-03-20 · CVE-2026-27593

Positive Technologies · (AI Summary)

CVSS v3.1

9.3

Critical

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Statmatic versions prior to 6.3.3 Statmatic versions prior to 5.73.10

Description An attacker can exploit a flaw in the password reset functionality to obtain a user's token and subsequently reset their password. The attacker requires the email address associated with a valid account. Successful exploitation depends on the user unknowingly clicking a link in an email they did not initiate. The vulnerable feature involves the password reset process, potentially impacting user account security.

Recommendations Update to Statmatic version 6.3.3 or later. Update to Statmatic version 5.73.10 or later.

Exploit

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2026-27593

GHSA-JXQ9-79VJ-RGVW

Affected Products

Statmatic

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27593.json · Exploit
• https://github.com/statamic/cms/commit/b2be592ddfb588bcb88c9be454f3590e14b145b0 · Patch
• https://github.com/statamic/cms/security/advisories/GHSA-jxq9-79vj-rgvw · Vendor Advisory
• https://github.com/statamic/cms/commit/6fdd03324982848e8754f2edd2265262d361714e · Patch
• https://github.com/statamic/cms/commit/78e63dfcf705b116d5ac0f7f7f5a1a69be63d1be · Patch
• https://osv.dev/vulnerability/CVE-2026-27593 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27593 · Security Note
• https://osv.dev/vulnerability/GHSA-jxq9-79vj-rgvw · Vendor Advisory
• https://github.com/statamic/cms · Note
• https://github.com/statamic/cms/releases/tag/v5.73.10 · Note
• https://github.com/statamic/cms/releases/tag/v6.3.3 · Note
• https://reddit.com/r/VulnMatter/comments/1refon9/resumen_diario_de_vulnerabilidades_25022026 · Reddit Post
• https://twitter.com/_cvereports/status/2026427081626652945 · Twitter Post
• https://twitter.com/pulsepatchio/status/2026674144826503358 · Twitter Post
• https://twitter.com/infoflowcloud/status/2026642484411920446 · Twitter Post