Medium severity6.2NVD Advisory· Published Aug 5, 2026· Updated Aug 26, 2026

CVE-2026-71293

Description

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
statamic/cmsPackagist	>= 6.0.0-alpha.1, <= 6.30.0	—

Affected products

Statamic/CMSllm-fuzzy

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-jppw-r5j3-xf7xghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-71293ghsaADVISORY
github.com/statamic/cms/blob/master/src/Auth/AugmentedUser.phpnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.403
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000