{"id":"CVE-2026-6816","summary":"TFA Basic Plugins - Access Bypass","details":"An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users.\n\n\nThis issue affects TFA Basic Plugins: from 7.x-1.0 through 7.x-1.2.","modified":"2026-07-23T03:56:36.965017521Z","published":"2026-05-28T22:50:49.419Z","database_specific":{"cwe_ids":["CWE-267"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6816.json","cna_assigner":"drupal"},"references":[{"type":"WEB","url":"https://git.drupalcode.org/project/tfa_basic"},{"type":"WEB","url":"https://www.drupal.org/project/tfa_basic"},{"type":"ADVISORY","url":"https://d7es.tag1.com/security-advisories/tfa-basic-plugins-less-critical-access-bypass-sa-contrib-2025-085"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6816.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6816"},{"type":"ADVISORY","url":"https://www.herodevs.com/vulnerability-directory/cve-2026-6816"},{"type":"EVIDENCE","url":"https://www.herodevs.com/vulnerability-directory/cve-2026-6816?nes-for-drupal-7"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.drupalcode.org/project/tfa_basic","events":[{"introduced":"ab4e3246272fd5c37dd63752addf570cf8d48bee"},{"last_affected":"3fa7576c32e5d6fe4f3a5ac417b27fc6f9587209"}],"database_specific":{"extracted_events":[{"introduced":"7.x-1.0"},{"last_affected":"7.x-1.2"}],"source":"AFFECTED_FIELD"}}],"versions":["7.x-1.2","7.x-1.1","7.x-1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6816.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}]}