CVE-2026-6816
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users, bypassing access controls.
Risk Assessment
The risk involves unauthorized access to recovery codes, potentially enabling an attacker to take over other user accounts and compromise system confidentiality and integrity.
Recommendation
It is recommended to immediately update the TFA Basic Plugins module to version 7.x-1.3 or later, which fixes this vulnerability.
Original NVD description (English source)
An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users. This issue affects TFA Basic Plugins: from 7.x-1.0 through 7.x-1.2.