CVE-2026-71293 statamic CVE debrief

Who should care

Statamic CMS users and administrators, security teams monitoring for 2FA bypass vulnerabilities, and operators of platforms using Statamic CMS should review and address this vulnerability. Affected teams should obtain and review user data flow configurations, especially blueprint settings for dynamic rendering, verify Statamic CMS version and patch status, and monitor for suspicious user data access patterns. Additionally, consider reviewing compensating controls for exposed systems while remediation is scheduled and verified. This vulnerability allows attackers to obtain 2FA recovery codes via dynamic Antlers template rendering, which can lead to 2FA bypass and potential unauthorized access to sensitive information. Therefore, it is crucial for the mentioned parties to take necessary actions to mitigate this vulnerability and protect their systems and data from potential exploitation. This may involve reviewing and updating existing security policies and procedures to ensure the secure use of Statamic CMS and its components. Furthermore, affected parties should consider tracking exceptions, retesting remediated assets, and closing the item only after evidence is documented to ensure that the vulnerability has been properly addressed. This should be done in accordance with existing change control and incident response processes to minimize potential disruptions and ensure the integrity of affected systems. Overall, a thorough review of the vulnerability and its potential impact on affected systems and data is necessary to determine the most effective course of action for mitigation and remediation. This review should be conducted in a timely manner to minimize potential risks and ensure the continued security and integrity of affected systems and data. The review process should involve relevant stakeholders, including security teams, system administrators, and other parties responsible for the management and maintenance of Statamic CMS and its components. By taking a proactive and thorough approach to addressing this vulnerability, affected parties can minimize potential risks and ensure the continued security and integrity of their systems and data. To further,

Technical summary

CVE-2026-71293 is a vulnerability in Statamic CMS's AugmentedUser resolver, which returns raw two-factor recovery codes without access restrictions. This allows attackers to obtain 2FA recovery codes via dynamic Antlers template rendering. The vulnerability exists because two_factor_recovery_codes is neither excluded from augmentation nor present in Statamic's Antlers variable guard lists. Exploitation requires that dynamic Antlers rendering already be enabled on a field the target user's data flows through, which is a blueprint-configuration privilege rather than a standard content-editing permission. To mitigate, review Statamic CMS version and apply patches, disable dynamic Antlers rendering for sensitive fields, restrict access to user data flow configurations, and monitor for suspicious user data access patterns.

Defensive priority

CVE-2026-71293 allows attackers to obtain 2FA recovery codes via dynamic Antlers template rendering. Obtain and review user data flow configurations, especially blueprint settings for dynamic rendering. Verify Statamic CMS version and patch status.

Recommended defensive actions

• Review Statamic CMS version and apply patches
• Disable dynamic Antlers rendering for sensitive fields
• Restrict access to user data flow configurations
• Monitor for suspicious user data access patterns
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE-2026-71293 issue arises from Statamic CMS's AugmentedUser resolver returning raw two-factor recovery codes without access restrictions. Evidence is based on official CVE and NVD records, and source code references. To verify, defenders should review Statamic CMS version and patch status, obtain and review user data flow configurations, especially blueprint settings for dynamic rendering, and monitor for suspicious user data access patterns. Additionally, consider reviewing compensating controls for exposed systems while remediation is scheduled and verified.

Official resources