CVE-2026-6816

TFA Basic Plugins - Access Bypass

State: Published
Severity: 5.1 Medium
Published: May 28, 2026
Updated: May 29, 2026
Reserved: Apr 21, 2026

Description

An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users.

This issue affects TFA Basic Plugins: from 7.x-1.0 through 7.x-1.2.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N	drupal

Weaknesses

CWE-267 Privilege Defined With Unsafe Actions

Affected Products

Product	Versions
TFA Basic PluginsDrupal	7.x-1.0 through 7.x-1.2Affected

References

Drupal security advisory SA-CONTRIB-2025-085third-party-advisory
https://d7es.tag1.com/security-advisories/tfa-basic-plugins-less-critical-access-bypass-sa-contrib-2025-085third-party-advisory
https://www.herodevs.com/vulnerability-directory/cve-2026-6816?nes-for-drupal-7exploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.