{"action":"Upgrade statamic/cms to 5.73.10 or later.","affected":[{"fixed":"5.73.10","introduced":"0"},{"fixed":"6.7.1","introduced":"6.0.0-alpha.1"}],"component":"statamic/cms","cve_ids":["CVE-2026-27593"],"ecosystem":"Packagist","epss":0.00634,"exploited":false,"fixed_versions":["5.73.10","6.7.1"],"ghsa_id":"GHSA-jxq9-79vj-rgvw","id":"tcs_01M5KF50TG7WFCXSW24X17BBSA","modified_at":"2026-03-19T21:16:33.258709Z","published_at":"2026-02-24T21:09:23Z","references":["https://osv.dev/vulnerability/GHSA-jxq9-79vj-rgvw","https://github.com/statamic/cms/security/advisories/GHSA-jxq9-79vj-rgvw","https://nvd.nist.gov/vuln/detail/CVE-2026-27593","https://github.com/statamic/cms/commit/6fdd03324982848e8754f2edd2265262d361714e","https://github.com/statamic/cms/commit/78e63dfcf705b116d5ac0f7f7f5a1a69be63d1be","https://github.com/statamic/cms/commit/b2be592ddfb588bcb88c9be454f3590e14b145b0","https://github.com/statamic/cms","https://github.com/statamic/cms/releases/tag/v5.73.10","https://github.com/statamic/cms/releases/tag/v6.3.3"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"GHSA-jxq9-79vj-rgvw","url":"https://osv.dev/vulnerability/GHSA-jxq9-79vj-rgvw"}],"summary":"Statamic is vulnerable to account takeover via password reset link injection"}