CVE-2026-63437 2FAuth: Missing Authorization on Share Recipients Endpoint Allows Cross-User Account Enumeration

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Prior to 8.0.0, the recipients method in app/Api/v1/Controllers/TwoFAccountShareController.php receives a caller-selected TwoFAccount through Laravel model binding but does not call the...