CVE-2026-6816: TFA Basic Plugins - Access Bypass
An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users.
This issue affects TFA Basic Plugins: from 7.x-1.0 through 7.x-1.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
TFA Basic Pluginsfrom your environment.Uninstall or disable the TFA Basic Plugins module (affected versions: 7.x-1.0 through 7.x-1.2) if it is not required.
- Configuration
Remove or unassign the 'administer users' permission from any roles that do not require it. Ensure only trusted administrator accounts retain this permission so they cannot view or generate other users' recovery codes via the TFA Basic Plugins.
Drupal (TFA Basic Plugins) permission: administer users = restricted to trusted administrators / remove from untrusted roles
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6816?
CVE-2026-6816 has a medium severity rating of 5.1 according to the CVSS scoring system.
How do I fix CVE-2026-6816?
To mitigate CVE-2026-6816, update the Drupal TFA Basic Plugins to version 7.x-1.3 or later.
What is CVE-2026-6816 about?
CVE-2026-6816 is an access bypass vulnerability that allows users with admin permissions to view or generate recovery codes for others.
Which versions of TFA Basic Plugins are affected by CVE-2026-6816?
CVE-2026-6816 affects TFA Basic Plugins versions from 7.x-1.0 through 7.x-1.2.
Who is affected by CVE-2026-6816?
CVE-2026-6816 affects Drupal sites using TFA Basic Plugins, specifically those with users assigned the administer users permission.