CVE-2026-6816

MEDIUM

TFA Basic Plugins - Access Bypass

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-6816 has a selected CVSS score of 5.1 (medium).

Description

An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users. This issue affects TFA Basic Plugins: from 7.x-1.0 through 7.x-1.2.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 29, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

TFA Basic Plugins

Browse Drupal / TFA Basic Plugins

Default status: unknown

CVE List7.x-1.0 to ≤ 7.x-1.2affected

References

4