CVE-2020-5240
2FA bypass through deleting devices in wagtail-2fa
CVE-2020-5240 is a high vulnerability (CVSS 7.6) in Lab Digital Wagtail-2fa, published March 13, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.00%, the 62nd percentile. Fixed in wagtail-2fa 1.4.1.
In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially compromise the account if they figure out their password. The problem has been patched in version 1.4.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
2FA bypass through deleting devices in wagtail-2fa
In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially compromise the account if they figure out their password. The problem has been patched in version 1.4.1.
- Record
CVE-2020-5240- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N - Weakness
- CWE-285
- Updated
- 2026-11-02
EUVDEUVD-2020-0234
In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially compromise the account if they figure out their password. The problem has been patched in version 1.4.1.
- Record
EUVD-2020-0234- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9gjv-6qq6-v7qm
2FA bypass through deleting devices in wagtail-2fa
Impact
Any user with access to the CMS can view and delete other users' 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other user's device they can disable the target user's 2FA devices and potentially compromise the account if they figure out their password.
Patches
The problem has been patched in version 1.4.1.
Workarounds
There is no workaround for this issue.
For more information
If you have any questions or comments about this advisory:
- Open an issue in github.com/labd/wagtail-2fa
- Email us at [email protected]
- Record
GHSA-9gjv-6qq6-v7qm- CVSS 4.0
- 6.2 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N - CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N - Weakness
- CWE-285
- Updated
- 2026-11-02
NVD
In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially compromise the account if they figure out their password. The problem has been patched in version 1.4.1.
- Record
CVE-2020-5240- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N - CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N - CVSS 2.0
- 5.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:N - Weakness
- CWE-285, CWE-863
- Updated
- 2026-11-02
OSV
In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially compromise the account if they figure out their password. The problem has been patched in version 1.4.1.
- Record
CVE-2020-5240- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-9gjv-6qq6-v7qm
2FA bypass through deleting devices in wagtail-2fa
Impact
Any user with access to the CMS can view and delete other users' 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other user's device they can disable the target user's 2FA devices and potentially compromise the account if they figure out their password.
Patches
The problem has been patched in version 1.4.1.
Workarounds
There is no workaround for this issue.
For more information
If you have any questions or comments about this advisory:
- Open an issue in github.com/labd/wagtail-2fa
- Email us at [email protected]
- Record
GHSA-9gjv-6qq6-v7qm- CVSS 4.0
- 6.2 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N - CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N - Weakness
- CWE-285
- Updated
- 2026-11-02
OSVPYSEC-2020-219 No score
In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially compromise the account if they figure out their password. The problem has been patched in version 1.4.1.
- Record
PYSEC-2020-219- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wagtail-2faPyPI |
before 1.4.1 | 1.4.1 |
wagtail-2faPyPI |
before 1.4.1, plus listed versions 0.0.10.0.20.0.30.1.01.0.0 Show 9 moreShow less1.0.11.1.01.2.01.3.01.3.11.3.21.3.31.3.41.4.0 |
1.4.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
github.com/labd/wagtail-2fa/security/advisories/GHSA-9gjv-6qq6-v7qm
nvd.nist.gov/vuln/detail/CVE-2020-5240