The vulnerability is an access bypass in Drupal TFA Basic Plugins. It permits a user who has the administer users role to view or generate two‑factor authentication recovery codes for any other user. This results in the exposed disclosure of sensitive recovery codes, enabling an attacker who compromises or uses an administrative account to reset other users’ passwords and gain unauthorized access. The weakness is an authorization bypass through privilege escalation (CWE‑267). The CVSS score of 5.1 indicates a medium severity with moderately high potential impact on confidentiality and integrity of user authentication data.

Affected components are Drupal TFA Basic Plugins versions 7.x‑1.0 through 7.x‑1.2. The issue is limited to these releases regardless of the Drupal core version. All installations that have not yet upgraded beyond 7.x‑1.2 are vulnerable.

The risk depends on the presence of accounts with the administer users permission. An attacker who gains or already possesses such administrative rights can easily generate recovery codes for other accounts. Because the exploit does not require network exposure or remote code execution, its practicality is confined to environments where administrator accounts are locally or remotely accessible. The EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that public exploitation is not yet known. Nonetheless, the moderate CVSS score highlights the importance of addressing this weakness before it is leveraged.