CVE-2026-71293: Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable
Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71293?
The severity of CVE-2026-71293 is medium with a score of 6.2.
What potential impacts does CVE-2026-71293 have?
CVE-2026-71293 affects the Statamic CMS and could expose users' recovery codes when accessed improperly.
How can I fix CVE-2026-71293?
To fix CVE-2026-71293, ensure that access restrictions are properly implemented for the two_factor_recovery_codes handle in your Statamic CMS.
Who is affected by CVE-2026-71293?
All users of Statamic CMS are potentially affected by CVE-2026-71293 if the vulnerability is not patched.
What is the description of CVE-2026-71293?
CVE-2026-71293 describes an unguarded exposure of two-factor recovery codes due to improper access control in Statamic CMS.