CVE-2026-71293

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71293", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-05T12:37:57.358Z", "datePublished": "2026-08-05T12:38:44.666Z", "dateUpdated": "2026-08-10T11:47:28.203Z"}, "containers": {"cna": {"title": "Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable", "descriptions": [{"lang": "en", "value": "Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction.</p>"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-200", "cweId": "CWE-200", "type": "CWE"}]}], "affected": [{"vendor": "statamic", "product": "cms", "programFiles": ["src/Auth/AugmentedUser.php", "src/Providers/ViewServiceProvider.php"], "versions": [{"version": "0", "lessThanOrEqual": "6.23.0", "status": "affected", "versionType": "semver"}], "defaultStatus": "unaffected"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N", "baseScore": 6.2, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}}], "references": [{"url": "https://github.com/statamic/cms", "tags": ["third-party-advisory"]}, {"url": "https://github.com/statamic/cms/blob/master/src/Auth/AugmentedUser.php", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Saidakbarxon Maxsudxonov", "type": "finder"}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:47:28.203Z"}, "source": {"discovery": "EXTERNAL"}, "datePublic": "2026-08-05T12:38:44.666Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-05T15:35:58.608812Z", "id": "CVE-2026-71293", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T15:36:07.527Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71293", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-05T15:35:58.608812Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T15:36:02.649Z"}}], "cna": {"title": "Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Saidakbarxon Maxsudxonov"}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "statamic", "product": "cms", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.23.0"}], "programFiles": ["src/Auth/AugmentedUser.php", "src/Providers/ViewServiceProvider.php"], "defaultStatus": "unaffected"}], "datePublic": "2026-08-05T12:38:44.666Z", "references": [{"url": "https://github.com/statamic/cms", "tags": ["third-party-advisory"]}, {"url": "https://github.com/statamic/cms/blob/master/src/Auth/AugmentedUser.php", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction.", "supportingMedia": [{"type": "text/html", "value": "<p>Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:47:28.203Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71293", "state": "PUBLISHED", "dateUpdated": "2026-08-10T11:47:28.203Z", "dateReserved": "2026-08-05T12:37:57.358Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-08-05T12:38:44.666Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "cms", "programFiles": ["src/Auth/AugmentedUser.php", "src/Providers/ViewServiceProvider.php"], "vendor": "statamic", "versions": [{"lessThanOrEqual": "6.23.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction."}, {"lang": "es", "value": "El resolvedor de aumento de usuario de Statamic CMS, AugmentedUser::get() en src/Auth/AugmentedUser.php, contiene un caso expl\u00edcito para el manejador \u2019two_factor_recovery_codes\u2019 que devuelve los c\u00f3digos de recuperaci\u00f3n de doble factor sin procesar del usuario sin restricci\u00f3n de acceso: \u2019if ($handle === \u2019two_factor_recovery_codes\u2019) { return new Value($this -> data -> get(\u2019two_factor_recovery_codes\u2019), ...); }\u2019. A diferencia de campos sensibles como password/password_hash, que est\u00e1n completamente excluidos de AugmentedUser, two_factor_recovery_codes no est\u00e1 excluido del aumento ni presente en las listas de protecci\u00f3n de variables Antlers de Statamic (guardedVariablePatterns/guardedContentVariablePatterns en src/Providers/ViewServiceProvider.php, y las rutas de protecci\u00f3n de GlobalRuntimeState en tiempo de ejecuci\u00f3n), que por defecto solo protegen config.app.key. En cualquier campo de plantilla Antlers donde la renderizaci\u00f3n de plantilla sin procesar/din\u00e1mica est\u00e9 habilitada para un campo dado (una opci\u00f3n de campo a nivel de blueprint, configurada por un administrador/desarrollador), una plantilla como \u2019{{ current_user.two_factor_recovery_codes }}{{ value }}|{{ /current_user.two_factor_recovery_codes }}\u2019 renderiza los propios c\u00f3digos de recuperaci\u00f3n 2FA del usuario que visualiza directamente en la respuesta HTML, permitiendo a un atacante que pueda ver o capturar esa respuesta (por ejemplo, a trav\u00e9s de una p\u00e1gina compartida/observable, o un enlace manipulado que haga que una v\u00edctima lo renderice) obtener los c\u00f3digos y eludir la 2FA. La explotaci\u00f3n requiere que la renderizaci\u00f3n din\u00e1mica de Antlers ya est\u00e9 habilitada en un campo por el que fluyen los datos del usuario objetivo, lo cual es un privilegio de configuraci\u00f3n de blueprint en lugar de un permiso est\u00e1ndar de edici\u00f3n de contenido."}], "id": "CVE-2026-71293", "lastModified": "2026-10-23T21:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 4.0, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71293", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-05T15:35:58.608812Z", "version": "2.0.3"}}]}, "published": "2026-08-05T13:24:54.060", "references": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/statamic/cms"}, {"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/statamic/cms/blob/master/src/Auth/AugmentedUser.php"}], "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.23.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "cms", "source": "cna", "vendor": "statamic"}, "product": "cms", "vendor": "statamic"}], "created": "2026-08-05T15:00:05.311802+00:00", "updated": "2026-08-10T21:00:04.271056+00:00", "vendors": ["statamic", "statamic$PRODUCT$cms"]}