CVE-2026-71293 is an information exposure vulnerability (CWE-200) in Statamic CMS's AugmentedUser::get() method. Specifically, the 'two_factor_recovery_codes' handle returns the user's raw 2FA recovery codes without access restrictions, unlike other sensitive fields. These codes are not excluded from augmentation or guarded by Statamic's variable guard lists. If dynamic Antlers template rendering is enabled on a blueprint-level field that outputs user data, an attacker who can view the rendered HTML can obtain the victim's 2FA recovery codes, potentially bypassing two-factor authentication. Exploitation requires blueprint configuration privileges to enable dynamic rendering on a field that includes the target user's data.

An attacker who can cause or observe the rendering of a page with dynamic Antlers template rendering enabled on a vulnerable field can obtain the victim user's raw two-factor recovery codes. This exposure allows bypassing two-factor authentication protections for that user. The vulnerability does not affect confidentiality of other data or system integrity directly but compromises the security of 2FA, increasing risk of account takeover. Exploitation requires elevated privileges to configure blueprint fields, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict blueprint-level privileges to trusted administrators only to prevent enabling dynamic Antlers rendering on fields that expose sensitive user data. Avoid enabling dynamic template rendering on fields that may output sensitive information such as two-factor recovery codes. Monitor vendor advisories for official patches or updates addressing this issue.