CVE-2026-6816
Access Bypass in Drupal TFA Basic Plugins
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: Drupal.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| drupal | tfa_basic_plugins | From 7.x-1.0 (inc) to 7.x-1.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-267 | A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an access bypass issue in the Drupal TFA Basic Plugins. It allows users who have the 'administer users' permission to view or generate recovery codes for other users. Essentially, it means that authorized administrators can access recovery codes that should be restricted, potentially compromising the security of two-factor authentication for other users.
The affected versions of the TFA Basic Plugins are from 7.x-1.0 through 7.x-1.2.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing users with administrative permissions to bypass intended access controls and obtain recovery codes for other users. This could lead to unauthorized access to user accounts if those recovery codes are used maliciously, undermining the security of two-factor authentication mechanisms.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows users with the administer users permission to view or generate recovery codes for other users, which could lead to unauthorized access to user accounts.
Such unauthorized access risks compromising sensitive personal data, potentially violating data protection regulations like GDPR and HIPAA that require strict controls over user data access and account security.
Therefore, this vulnerability may negatively impact compliance with these standards by undermining the confidentiality and integrity of user authentication mechanisms.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability affects the TFA Basic Plugins module for Drupal 7 versions 7.x-1.0 through 7.x-1.2. Detection involves verifying if your Drupal installation uses one of these vulnerable versions of the module.
Since the vulnerability allows users with the "administer users" permission to view or generate recovery codes for other users, monitoring access logs for unusual access patterns to TFA recovery routes or attempts to access other users' TFA settings can help detect exploitation attempts.
Specific commands are not provided in the available resources, but you can check the installed module version using Drush or Drupal's administrative interface. For example, using Drush:
- drush pm-list --type=Module --status=enabled | grep tfa_basic
Additionally, reviewing web server logs for requests to TFA recovery or setup URLs that are accessed by users with the "administer users" permission may help identify suspicious activity.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation is to upgrade the TFA Basic Plugins module to version 7.x-1.3 or later, where the vulnerability is fixed by restricting access to TFA setup and recovery actions to the account owner only.
Until the module is updated, temporary mitigations include hard-blocking vulnerable routes at the Web Application Firewall (WAF) layer to prevent unauthorized access to TFA recovery and setup endpoints.
Also, review and limit the assignment of the "administer users" permission to only trusted administrators, as the vulnerability requires this permission to be exploited.