medium6.2
CVE-2026-71293
Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's r…
Impact
Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | statamic/cms | >= 6.0.0-alpha.1, <= 6.30.0 | none recorded |