CVE-2026-71293CWE-200information-disclosure

CVE-2026-71293

Medium · published August 5, 2026

CVSS v3.1
6.2
EPSS
0%
Percentile
29.9
In the wild
Unconfirmed
What it is

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction.

The record
Technical detail
CVSS v3.1
6.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00372 · 29.9th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-08-05T17:24Z
References (2)
https://github.com/statamic/cms · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://github.com/statamic/cms/blob/master/src/Auth/AugmentedUser.php · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
EPSS history
Timeline
  • 05 AUG 12:38Z
    Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable
    cvelistv5