Description
An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users. This issue affects TFA Basic Plugins: from 7.x-1.0 through 7.x-1.2.
Affected products
tfa_basic_plugins_project: tfa basic plugins
References3
- www.herodevs.com/vulnerability-directory/cve-2026-6816 ExploitThird Party Advisory
- www.herodevs.com/vulnerability-directory/cve-2026-6816?nes-for-… ExploitThird Party Advisory
- d7es.tag1.com/security-advisories/tfa-basic-plugins-less-critic… Third Party Advisory
Metrics
- CVSS 3.1
-
3.8
LOW
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - CVSS 4.0
-
5.1
MEDIUM
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 0% percentile: 25 · as of 15 November 2026
- CWE
- CWE-267
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.