EPSS
Percentile
42.8%
Statamic framework before 2.6.0 does not correctly check a sessionβs permissions when the methods from a userβs class are called. Problematic methods include reset password, create new account, create new role, etc.
nvd.nist.gov/vuln/detail/CVE-2017-11422