The vulnerability resides in Statamic's password‑reset feature. An attacker who knows a target user's e‑mail address can obtain the reset token and force a password change, enabling full account takeover without the user's knowledge. The flaw is classified as CWE‑640, reflecting impersonation through compromised credentials.

Statamic CMS is affected. Versions earlier than 6.3.3 for the latest major release and earlier than 5.73.10 for the legacy release are vulnerable. All deployments of Statamic that have not applied these patches remain at risk.

The CVSS score of 9.3 signals critical severity. Exploitation probability is currently very low, with an EPSS score below 1 %. The vulnerability is not in the CISA KEV catalog. Exploitation requires the attacker to exploit the exposed password‑reset link; the user must receive and click the unfamiliar link, a classic click‑through scenario. Once the attacker supplies a valid e‑mail address, the reset token is captured and the password is overwritten, giving the attacker full control of the account.