CVE-2026-27593

statamic

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-27593

Katalog CVE

CVSS 8.8 · High EPSS 0,57%

Kerentanan Weak Password Recovery Mechanism for Forgotten Password pada statamic. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker must know the email address of a valid account on the site, and the actual user must blindly click the link in their email even though they didn't request the reset. This has been fixed in 6.3.3 and 5.73.10.

Rincian

Terbit di NVD
24 Februari 2026
Terakhir diubah
17 Juni 2026
Status NVD
Analyzed
CVSS 3.1
8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-640: Weak Password Recovery Mechanism for Forgotten Password
EPSS (30 hari)
0,57% peluang dieksploitasi; lebih tinggi dari 45,4% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
statamic statamic Semua versi sebelum 5.73.10
statamic statamic Versi 6.0.0 hingga sebelum 6.3.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.