Statamic CMS's AugmentedUser::get method in src/Auth/AugmentedUser.php contains an explicit case for the handle that returns the raw two-factor recovery codes of users without enforcing access controls. This constitutes a CWE-200 (Information Exposure) vulnerability, potentially allowing privileged users to retrieve sensitive authentication recovery data. The CVSS 3.1 score is 6.2 (medium), reflecting network attack vector, low attack complexity, high privileges required, user interaction required, and high confidentiality impact with no integrity or availability impact. No patch or official remediation level has been published as of the data provided.

An attacker with high privileges and user interaction could retrieve raw two-factor authentication recovery codes of users, leading to potential compromise of user accounts if these codes are used to bypass two-factor authentication. The confidentiality of sensitive authentication data is directly impacted. There is no impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to high privilege accounts and monitor for unauthorized access to two-factor recovery codes. Avoid sharing or exposing recovery codes unnecessarily.