CVE-2026-6816

5.1 mediumEPSS 0.3%

Medium (5.1) in tfa basic plugins project tfa basic plugins. EPSS 0.3% chance of exploitation in the next 30 days.

An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users. This issue affects TFA Basic Plugins: from 7.x-1.0 through 7.x-1.2.

Severity

CVSS 4.0

5.1 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

3.8 low

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
CWE: CWE-267
Published: 2026-05-28
Modified: 2026-07-21
Record from: the NVD, synced 2026-10-19

Affected

tfa_basic_plugins_project:tfa_basic_plugins

References

https://d7es.tag1.com/security-advisories/tfa-basic-plugins-less-critical-access-bypass-sa-contrib-2025-085
https://www.herodevs.com/vulnerability-directory/cve-2026-6816
https://www.herodevs.com/vulnerability-directory/cve-2026-6816?nes-for-drupal-7

Check your stack JSON