The vulnerability originates from the recipients() method within TwoFAccountShareController. The method binds to a TwoFAccount model but fails to invoke the manageShares authorization policy, which permits any authenticated user to retrieve the sharing information of accounts they do not own. This disclosure includes the account’s recipient list, user IDs, display names, and email addresses (especially with the filter option), effectively enabling enumeration of other users in the system.

All installations of 2FAuth built by Bubka prior to version 8.0.0 remain susceptible. The issue is fixed in release 8.0.0, which introduces proper authorization checks on the recipients endpoint. Therefore any environment running 2FAuth prior to v8.0.0 is at risk.

The CVSS base score of 6.5 indicates moderate severity, primarily because the vulnerability requires authentication and does not provide direct code execution or privilege escalation. The EPSS score is not available, and the item is not listed in CISA’s KEV catalog, implying no known public exploitation at the time of analysis. Despite this, the attack vector is straightforward: an authenticated attacker can access the API endpoint and enumerate user identities. The presence of CWE‑639 and CWE‑862 highlights the missing authorization checks.