CVE-2026-6816 TFA Basic Plugins - Access Bypass
Users with administer users permission can view or generate recovery codes for other users, bypassing two-factor authentication controls.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6816?
CVE-2026-6816 is a medium-severity missing authorization vulnerability in Drupal TFA Basic Plugins, published on 28 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users.
This issue affects TFA Basic Plugins: from 7.x-1.0 through 7.x-1.2.
Weakness: CWE-267
Which versions are affected by CVE-2026-6816?
It affects 1 product.
Products include Tfa Basic Plugins Project Tfa Basic Plugins.
How do I fix CVE-2026-6816?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-6816 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-6816 exists.
Sources
Also known as CLSA-2026-1789638824, GHSA-rgcr-rww9-8rr3.