← Back

CVE-2026-71293

nvd nist
Published: Aug 5, 2026Modified: Oct 23, 2026Deferred

JSON object

Loading...
6.2
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
Exploitability: 1.7 / Impact: 4.0
Source: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c (Secondary)

Description

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction.

Related CWEs

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

Source: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
Source: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Timeline

No history available yet.