Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable
CVSS score
6.2
EPSS probability
%0.4
Risk score
0.0
Published
2 mo ago
Resmî kaynaklarda yeterli kanıt bulunamadı. Bu sonuç “yama yok” anlamına gelmez.
Impact on My Inventory
Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.
Checking session…
Vulnerability description
CVE AI research
DayBreach AI Explanation
Verified against sourcesSources read
1
Source agreement
Tam uyum
Evidence confidence
%53
Short explanation
Statamic CMS exposes two-factor recovery codes via Antlers current_user variable due to unguarded access in AugmentedUser::get(). Exploitation requires dynamic rendering on a blueprint field. Vulnerability affects versions up to 6.23.0. No official patch status is available. CVSS score is 6.2 (Medium).
Exposure of 2FA recovery codes undermines user security, enabling attackers to bypass authentication. This is particularly critical in shared or observable environments where responses are publicly accessible. The vulnerability is tied to configuration, not user actions, making it a persistent risk in misconfigured systems.
What should be done?
- Disable dynamic rendering for fields that handle user data in Antlers templates.
- Review and restrict blueprint-level field configurations to prevent exposure of sensitive user data.
- Ensure that sensitive fields like two_factor_recovery_codes are excluded from augmentation or guarded by runtime variable guards.
The sources give limited detail on some technical conditions. Review the chain of evidence below before deciding how to act.
Chain of evidence and sources
Statamic CMS, 6.23.0 ve alt sürüllerinde, Antlers current_user değişkeni aracılığıyla iki faktörlü kimlik doğrulama (2FA) geri kazanma kodlarını korumaksızın açığa çıkarır. Bu, bir blueprint alanı için dinamik şablon renderlama etkinleştirildiğinde, saldırıcının gözlemlenebilir yanıtlar üzerinden bu kodları elde edebilmesine neden olur.
Açık, src/Auth/AugmentedUser.php dosyasındaki AugmentedUser::get() metodunda, two_factor_recovery_codes alanının erişim kısıtları olmadan döndüğü için mevcuttur. Şifreleme alanları gibi password_hash gibi hassas alanlar tamamen augmente edilmeden dışlanırken, bu alan dışlanmamıştır.
Saldırı, hedef kullanıcı verilerinin akıştığı bir alan üzerinde dinamik renderlama etkinleştirilmiş olması gerekir. Bu, içerik düzenleme izni yerine bir şablon yapılandırması yetkisidir.
Show the technical text from the sources
Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
CWE: CWE-200, CWE-522
Explanation produced with the local qwen3:4b-instruct model. Numerical metrics and the KEV, patch and exploit statuses are not determined by AI.
IMPACT: Affected Products and Software
RED HAT CSAF/VEX: Product Impact Check
SCORING: CVSS from Multiple Sources
CVSS Scores
The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.
| SCORE | VERSION | SEVERITY | VECTOR | SOURCE |
|---|---|---|---|---|
| 6.2 | CVSS V3_1 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N | CVE CNA |
| 6.2 | CVSS 3.x | — | Vector not published | GitHub Advisory |
| 6.2 | CVSS V31 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N | NVD |
| 0.0 | CVSS 4.0 | — | Vector not published | GitHub Advisory |
Patch and Remediation Guide
Solution & Remediation Advisory
İncelenen resmî kaynaklarda yama durumu doğrulanamadı. Bu sonuç “yama yok” anlamına gelmez.
Public exploit and active exploitation status
Verified exploit intelligence
No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.
Weakness Classification and Attack Patterns (CWE & CAPEC)
CWE - Common Weakness Enumeration
While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-71293 is associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-71293 weaknesses.
Attack Vector and Accessibility
Official Sources and Advisories
CVSS Vector Radar Chart
6.2 / 10Vulnerability Scoring Details
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:NYama durumu bilinmiyor
Weakness Type (CWE & CAPEC)
Similar Vulnerabilities
Shopper: privilege escalation via improper Livewire admin component authorization
svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences
Grav before 2.0.2 Config Exfiltration via offsetGet Filter
OpenSTAManager has HTML Injection in modules/utenti/edit.php
phpSysInfo: IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers
LibreNMS: Remote Code Execution by Signal Alert Transportation Module
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-71293"