What is the CVSS score of CVE-2026-27593?

CVE-2026-27593 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Laravel are affected by CVE-2026-27593?

A critical vulnerability in Statmatic's password reset feature allows attackers to hijack user accounts by intercepting password reset tokens, potentially compromising administrative access and…. A patch is available.

How to fix or mitigate CVE-2026-27593?

Within 24 hours: Identify all Statmatic instances and document current versions in use; notify system owners and relevant stakeholders of the critical risk. Within 7 days: Apply vendor patches to upgrade to versions 6.3.3 or 5.73.10 across all production and non-production environments; verify patch deployment with version confirmation. Within 30 days: Conduct post-incident review; audit password reset logs for suspicious activity during the vulnerability window; force password resets for all administrative accounts and review account access logs for unauthorized changes.

Laravel CVE-2026-27593

CRITICAL

Weak Password Recovery Mechanism for Forgotten Password (CWE-640)

2026-02-24 security-advisories@github.com

GHSA-jxq9-79vj-rgvw

Laravel Statamic

9.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Feb 25, 2026 - 20:27 nvd

Patch available

CVE Published

Feb 24, 2026 - 22:16 nvd

CRITICAL 9.3

DescriptionGitHub Advisory

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker must know the email address of a valid account on the site, and the actual user must blindly click the link in their email even though they didn't request the reset. This has been fixed in 6.3.3 and 5.73.10.

AnalysisAI

Password reset poisoning in Statamic CMS before 6.3.3/5.73.10 allows attackers to steal password reset tokens by manipulating the Host header in reset requests. Patch available.

Technical ContextAI

CWE-640 weak password recovery mechanism. Attacker manipulates the Host header in password reset requests, causing reset links to point to attacker-controlled domain.

RemediationAI

Update Statamic. Configure APP_URL and ignore Host headers for URL generation.

More in Laravel

View all

CVE-2017-16894 HIGH Act Now POC

7.5 Nov 20

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwo

CVE-2025-54068 CRITICAL Act Now POC

9.8 Jul 17

Laravel Livewire v3 through v3.6.3 contains a critical remote code execution vulnerability (CVE-2025-54068, CVSS 9.8) th

CVE-2025-53833 CRITICAL Act Now POC

10.0 Jul 14

LaRecipe versions prior to 2.8.1 contain a Server-Side Template Injection (SSTI) vulnerability that can lead to Remote C

CVE-2026-28289 CRITICAL Act Now POC

10.0 Mar 03

File upload bypass in FreeScout 1.8.206 — patch bypass for CVE-2026-27636. PoC and patch available. CVSS 10.0.

CVE-2026-27636 HIGH Act Now POC

8.8 Feb 25

Remote code execution in FreeScout prior to version 1.8.206 allows authenticated users to upload `.htaccess` files that

CVE-2018-15133 HIGH Act Now POC

8.1 Aug 09

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unseri

CVE-2025-70841 CRITICAL Act Now POC

10.0 Feb 03

Dokans SaaS e-commerce platform v3.9.2 has a CVSS 10.0 authentication bypass allowing unauthenticated attackers to obtai

CVE-2026-27637 CRITICAL Act Now POC

9.8 Feb 25

Predictable password reset tokens in FreeScout help desk before 1.8.206. Weak random number generation allows attackers

CVE-2026-21448 CRITICAL Act Now POC

9.8 Jan 02

Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address

CVE-2026-21446 CRITICAL Act Now POC

9.8 Jan 02

Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauth

CVE-2022-2870 CRITICAL Act Now POC

9.8 Aug 17

A vulnerability was found in laravel 5.1 and classified as problematic. Rated critical severity (CVSS 9.8), this vulnera

CVE-2026-21449 HIGH This Week POC

8.8 Jan 02

Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable f

Same weakness CWE-640 – Weak Password Recovery Mechanism for Forgotten Password

View all

CVE-2023-7028 CRITICAL POC

10.0

CVE-2017-7615 HIGH POC

8.8

CVE-2017-8295 MEDIUM POC

5.9

CVE-2025-6216 CRITICAL POC

9.8

CVE-2025-47646 CRITICAL POC

9.8

CVE-2015-7257 HIGH POC

7.5

CVE-2022-50910 CRITICAL POC

9.8

CVE-2026-12417 CRITICAL POC

9.8

CVE-2026-27593 vulnerability details – vuln.today

Back