CVE-2020-5240

CVE-2020-5240 affects wagtail-2fa prior to 1.4.1. Any CMS user can view and delete other users’ 2FA devices by accessing a specific path, bypassing permissions and potentially compromising accounts. The root issue is an authorization flaw that does not require special permissions to manipulate an...

CVE-2019-16766

Summary: CVE-2019-16766 affects the wagtail-2fa package prior to 1.3.0. If an attacker gains a user’s Wagtail credentials, they can bypass the two‑factor check by modifying the URL, then add a new device and gain full CMS access. The issue is resolved in version 1.3.0. Impact details (as describe...