CVE-2026-6816CWE-267

TFA Basic Plugins - Access Bypass

Medium · published May 28, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
31.6
In the wild
Unconfirmed
What it is

An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users.

This issue affects TFA Basic Plugins: from 7.x-1.0 through 7.x-1.2.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00387 · 31.6th percentile
Weakness
CWE-267 · Privilege Defined With Unsafe Actions
Published
2026-05-28T22:50Z
EPSS history
Timeline
  • 28 MAY 22:50Z
    TFA Basic Plugins - Access Bypass
    cvelistv5