{"id":"CVE-2025-7030","aliases":["DRUPAL-CONTRIB-2025-085","EUVD-2025-20698","GHSA-93j9-6whq-hmr3"],"status":"published","title":"Two-factor Authentication (TFA) - Less critical - Access bypass - SA-CONTRIB-2025-085","description":"Privilege Defined With Unsafe Actions vulnerability in Drupal Two-factor Authentication (TFA) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.11.0.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00412,"percentile":0.35776,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-267"],"published":"2025-07-02T17:37:03Z","modified":"2026-09-10T03:46:13Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/tfa","fixed_in":["1.11.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/tfa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0"}]}]}],"products":[{"vendor":"drupal","product":"two-factor authentication (tfa)"},{"vendor":"two-factor_authentication_project","product":"two-factor_authentication"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2025-085","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-7030"},{"url":"https://github.com/advisories/GHSA-93j9-6whq-hmr3"}],"sources":{"cve":[{"id":"CVE-2025-7030","title":"Two-factor Authentication (TFA) - Less critical - Access bypass - SA-CONTRIB-2025-085","description":"Privilege Defined With Unsafe Actions vulnerability in Drupal Two-factor Authentication (TFA) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.11.0.","status":"published","published":"2025-07-08T20:54:13.917Z","modified":"2025-07-09T14:23:22.669Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-267"],"updated_at":"2026-11-02T14:32:51.544289Z"}],"euvd":[{"id":"EUVD-2025-20698","description":"Privilege Defined With Unsafe Actions vulnerability in Drupal Two-factor Authentication (TFA) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.11.0.","status":"published","published":"2025-07-08T20:54:13Z","modified":"2025-07-09T14:23:22Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T20:32:10.524333Z"}],"ghsa":[{"id":"GHSA-93j9-6whq-hmr3","title":"Privilege Defined With Unsafe Actions vulnerability in Drupal Two-factor Authentication (TFA)...","description":"Privilege Defined With Unsafe Actions vulnerability in Drupal Two-factor Authentication (TFA) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.11.0.","status":"published","published":"2025-07-08T21:30:29Z","modified":"2025-07-09T15:30:44Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H","level":"medium"}],"cwes":["CWE-267"],"updated_at":"2026-11-02T15:02:58.210008Z"}],"nvd":[{"id":"CVE-2025-7030","description":"Privilege Defined With Unsafe Actions vulnerability in Drupal Two-factor Authentication (TFA) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.11.0.","status":"published","published":"2025-07-08T21:15:28.773Z","modified":"2026-06-17T10:04:07.86Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-267"],"updated_at":"2026-11-02T14:11:17.727956Z"}],"osv":[{"id":"DRUPAL-CONTRIB-2025-085","description":"This module enables you to allow and/or require a second authentication method in addition to password authentication.\n\nThe module does not sufficiently ensure that users with enhanced privileges are prevented from viewing recovery codes of other users.\n\nThis vulnerability is mitigated by the fact that an attacker must have a role with the *Administer TFA for other users* permission.","status":"published","published":"2025-07-02T17:37:03Z","modified":"2026-09-10T03:46:13.719537608Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}