2FAuth: Missing Authorization on Share Recipients Endpoint Allows Cross-User Account Enumeration

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the recipients() method in app/Api/v1/Controllers/TwoFAccountShareController.php receives a caller-selected TwoFAccount through Laravel model binding but does not call the manageShares authorization policy before listing its recipients. When account sharing is enabled, an authenticated user can call GET /api/v1/twofaccounts/{victimId}/recipients for accounts owned by other users, enumerate registered user IDs and display names, test exact email addresses with filter[nameOrEmail], and inspect each account's sharing relationships. This issue is fixed in version 8.0.0.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…2FAuth/security/advisories/GHSA-m52c-63g8-qg5c Diğer
• github.com/…ommit/08753afbd847da8fa285e2ad857693ff88e46b84 Diğer
• github.com/Bubka/2FAuth/releases/tag/v8.0.0 Diğer

Kayıt geçmişi

1. 6 Kas 2026 23:16Yayımlandı

İlgili açıklar

• 9,8 CVE-2026-634392FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy Verification
• 9,8 CVE-2026-634382FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header Value
• 5,9 CVE-2026-634402FAuth: Authenticated SSRF via DNS rebinding in the otpauth image= icon fetch (validate-then-fetch TOCTOU)
• 4,9 CVE-2026-634412FAuth: SSRF guard misses IPv6 NAT64 prefixes, allowing image fetch to reach internal/metadata targets
• 6,5 CVE-2026-85737Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin
• 6,5 CVE-2026-63664CloudBeaver: Authorization Bypass (BFLA) - Data Export Restriction Bypass