CVE-2026-71293 Overview
CVE-2026-71293 is an information disclosure vulnerability in Statamic CMS's user-augmentation resolver. The AugmentedUser::get() method in src/Auth/AugmentedUser.php contains an explicit branch for the two_factor_recovery_codes handle that returns the raw recovery codes without access restriction. Unlike password and password_hash, which are excluded from augmentation entirely, two_factor_recovery_codes is neither excluded nor listed in Statamic's Antlers variable guard lists. An attacker able to influence an Antlers template with dynamic rendering enabled can leak a viewing user's own 2FA recovery codes into the HTML response and bypass 2FA. This weakness is classified under CWE-200: Exposure of Sensitive Information.
Critical Impact
Attackers can exfiltrate a target user's two-factor recovery codes and bypass 2FA on affected Statamic CMS deployments.
Affected Products
- Statamic CMS (statamic/cms)
- Deployments with dynamic Antlers rendering enabled on blueprint fields
- Sites relying on Statamic-managed two-factor authentication
Discovery Timeline
- 2026-08-05 - CVE-2026-71293 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-71293
Vulnerability Analysis
Statamic's AugmentedUser class exposes user attributes to the Antlers templating engine. The resolver includes a dedicated branch that returns two_factor_recovery_codes as a Value object when that handle is requested. Sensitive fields such as password and password_hash are excluded from augmentation, but recovery codes are not. Statamic's Antlers guard lists, guardedVariablePatterns and guardedContentVariablePatterns defined in src/Providers/ViewServiceProvider.php, along with the runtime GlobalRuntimeState guard paths, protect only config.app.key by default. The recovery codes handle therefore remains reachable through Antlers tag pairs referencing current_user.
Root Cause
The root cause is a missing exclusion in the augmentation layer combined with an incomplete guard list. The augmentation resolver treats two_factor_recovery_codes as any other public user attribute, and no template-side guard prevents rendering it. Access control is delegated to blueprint configuration rather than enforced at the sensitive-data boundary.
Attack Vector
Exploitation requires a field where dynamic Antlers rendering is enabled, a blueprint-level configuration option controlled by administrators or developers. On such a field, a payload similar to {{ current_user.two_factor_recovery_codes }}{{ value }}|{{ /current_user.two_factor_recovery_codes }} renders the viewing user's own recovery codes into the response HTML. An attacker who can view or capture that response, for example through a shared page or a crafted link that induces a victim to render the template, obtains the codes and bypasses 2FA. The attack requires high privileges to alter blueprint content and user interaction to render the malicious template.
Detection Methods for CVE-2026-71293
Indicators of Compromise
- Antlers template source containing references to current_user.two_factor_recovery_codes or the singular handle in any blueprint field.
- HTTP responses from authenticated Statamic pages that contain strings matching known recovery-code formats.
- Unexpected changes to blueprint YAML enabling antlers: true on user-facing fields.
Detection Strategies
- Perform static review of blueprint YAML files under resources/blueprints/ for fields with dynamic Antlers rendering enabled.
- Grep the content and template repositories for the token two_factor_recovery_codes outside of Statamic core code.
- Monitor version control commits that toggle Antlers rendering on fields flowing user-augmented data.
Monitoring Recommendations
- Log and alert on outbound HTML responses containing recovery-code patterns from authenticated CMS endpoints.
- Track 2FA recovery-code usage events and correlate with recent template edits or blueprint changes.
- Review Statamic control-panel audit trails for blueprint modifications by non-privileged accounts.
How to Mitigate CVE-2026-71293
Immediate Actions Required
- Upgrade Statamic CMS to the vendor-patched release that removes two_factor_recovery_codes from AugmentedUser resolution.
- Disable dynamic Antlers rendering on any blueprint field that does not strictly require it.
- Invalidate and regenerate two-factor recovery codes for all users after applying the patch.
Patch Information
Refer to the Statamic CMS repository and the AugmentedUser source file for the fixed implementation and release notes. Apply the latest maintenance release for your installed major version.
Workarounds
- Remove or set to false the antlers option on blueprint fields where user data is rendered.
- Restrict blueprint-editing permissions to a minimal set of trusted administrators.
- Add a temporary application-level filter that strips two_factor_recovery_codes references from rendered Antlers content.
# Locate blueprints with dynamic Antlers rendering enabled
grep -R "antlers: true" resources/blueprints/
# Search for template references to the vulnerable handle
grep -R "two_factor_recovery_codes" resources/ content/
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
