{"id":"CVE-2026-63437","kind":"vulnerability","aliases":["CVE-2026-63437"],"related":[],"title":"2FAuth: authenticated users can list recipients of other users' accounts","description":"2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the recipients() method in app/Api/v1/Controllers/TwoFAccountShareController.php receives a caller-selected TwoFAccount through Laravel model binding but does not call the manageShares authorization policy before listing its recipients. When account sharing is enabled, an authenticated user can call GET /api/v1/twofaccounts/{victimId}/recipients for accounts owned by other users, enumerate registered user IDs and display names, test exact email addresses with filter[nameOrEmail], and inspect each account's sharing relationships. This issue is fixed in version 8.0.0.","summary":"2FAuth, a self-hosted web app that stores two-factor authentication accounts, lets any logged-in user call an API endpoint that lists the recipients of accounts they do not own. An attacker can enumerate user IDs, display names and test exact email addresses, and see each account's sharing relationships.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["2fauth","laravel","package","self-hosted"],"not_affected_if":["sharing-disabled","version-8.0.0-or-later"],"how_to_check":"- Check the installed 2FAuth version; the fix is in `8.0.0` and earlier versions are affected.\n- Check whether account sharing is enabled in the 2FAuth configuration.\n- Review API access logs for `GET /api/v1/twofaccounts/{id}/recipients` requests from users who do not own that account.","fix":"- 2FAuth: upgrade to `8.0.0`.","status":"open","published_at":"2026-11-06T21:17:09+00:00","first_seen_at":"2026-11-06T21:45:07+00:00","triaged_at":"2026-11-06T21:46:43+00:00","updated_at":"2026-11-06T21:46:43+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T21:46:43Z","model":"claude-haiku-5-5","output":{"fix":"- 2FAuth: upgrade to `8.0.0`.","reach":"network","title":"2FAuth: authenticated users can list recipients of other users' accounts","impact":"low","summary":"2FAuth, a self-hosted web app that stores two-factor authentication accounts, lets any logged-in user call an API endpoint that lists the recipients of accounts they do not own. An attacker can enumerate user IDs, display names and test exact email addresses, and see each account's sharing relationships.","audience":"businesses","category":"package","nicknames":[],"who_cares":["2fauth","self-hosted","laravel"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker enumerates users and sharing relationships across other users' accounts.","analyst_note":"","how_to_check":"- Check the installed 2FAuth version; the fix is in `8.0.0` and earlier versions are affected.\n- Check whether account sharing is enabled in the 2FAuth configuration.\n- Review API access logs for `GET /api/v1/twofaccounts/{id}/recipients` requests from users who do not own that account.","plain_action":"","needs_analyst":false,"not_affected_if":["sharing-disabled","version-8.0.0-or-later"],"who_is_affected":"Teams running a self-hosted 2FAuth instance on a version before 8.0.0 with account sharing enabled are exposed, since any authenticated user can query recipients of other users' accounts. Instances with sharing disabled, or that are only used by a single trusted user, carry much less risk.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00073,"input_tokens":4409,"output_tokens":579,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-63437':13A,16A '/api/v1/twofaccounts':136C '/recipients':138C '2fa':88C '2fauth':1A,17B,23B,77C '8.0.0':97C,172C 'account':10A,36B,52B,73B,89C,126C,140C,162C 'address':69B,155C 'api':45B 'app':29B,81C 'app/api/v1/controllers/twofaccountsharecontroller.php':102C 'attack':58B 'authent':2A,35B,87C,131C 'author':119C 'bind':112C 'call':43B,116C,134C 'caller':106C 'caller-select':105C 'code':94C 'cve':11A,14A 'display':63B,150C 'email':68B,154C 'enabl':129C 'endpoint':46B 'enumer':60B,145C 'exact':67B,153C 'factor':34B,86C 'filter':157C 'fix':169C 'generat':91C 'get':135C 'host':22B,27B 'id':62B,148C 'inspect':160C 'issu':167C 'laravel':18B,110C 'let':37B 'list':5A,48B,122C 'log':40B 'logged-in':39B 'manag':83C 'manageshar':118C 'method':100C 'model':111C 'name':64B,151C 'nameoremail':158C 'own':141C 'packag':19B 'polici':120C 'prior':95C 'receiv':103C 'recipi':6A,50B,99C,124C 'regist':146C 'relationship':76B,165C 'secur':93C 'see':71B 'select':107C 'self':21B,26B 'self-host':20B,25B 'share':75B,127C,164C 'store':31B 'test':66B,152C 'two':33B,85C 'two-factor':32B,84C 'twofaccount':108C 'user':3A,9A,42B,61B,132C,144C,147C 'version':171C 'victimid':137C 'web':28B,80C","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted 2FAuth instance on a version before 8.0.0 with account sharing enabled are exposed, since any authenticated user can query recipients of other users' accounts. Instances with sharing disabled, or that are only used by a single trusted user, carry much less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["2fauth","laravel","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-2026':12A,15A '-63437':13A,16A '2fauth':1A 'account':10A 'authent':2A 'cve':11A,14A 'list':5A 'recipi':6A 'user':3A,9A","search_b":"'2fauth':17B,23B 'account':36B,52B,73B 'address':69B 'api':45B 'app':29B 'attack':58B 'authent':35B 'call':43B 'display':63B 'email':68B 'endpoint':46B 'enumer':60B 'exact':67B 'factor':34B 'host':22B,27B 'id':62B 'laravel':18B 'let':37B 'list':48B 'log':40B 'logged-in':39B 'name':64B 'packag':19B 'recipi':50B 'relationship':76B 'see':71B 'self':21B,26B 'self-host':20B,25B 'share':75B 'store':31B 'test':66B 'two':33B 'two-factor':32B 'user':42B,61B 'web':28B","search_c":"'/api/v1/twofaccounts':136C '/recipients':138C '2fa':88C '2fauth':77C '8.0.0':97C,172C 'account':89C,126C,140C,162C 'address':155C 'app':81C 'app/api/v1/controllers/twofaccountsharecontroller.php':102C 'authent':87C,131C 'author':119C 'bind':112C 'call':116C,134C 'caller':106C 'caller-select':105C 'code':94C 'display':150C 'email':154C 'enabl':129C 'enumer':145C 'exact':153C 'factor':86C 'filter':157C 'fix':169C 'generat':91C 'get':135C 'id':148C 'inspect':160C 'issu':167C 'laravel':110C 'list':122C 'manag':83C 'manageshar':118C 'method':100C 'model':111C 'name':151C 'nameoremail':158C 'own':141C 'polici':120C 'prior':95C 'receiv':103C 'recipi':99C,124C 'regist':146C 'relationship':165C 'secur':93C 'select':107C 'share':127C,164C 'test':152C 'two':85C 'two-factor':84C 'twofaccount':108C 'user':132C,144C,147C 'version':171C 'victimid':137C 'web':80C","first_public_at":"2026-07-01T21:32:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63437","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63437","severity":null,"published_at":"2026-11-06T21:17:09+00:00","modified_at":"2026-11-06T21:17:09+00:00","first_seen_at":"2026-11-06T21:45:07+00:00","fetched_at":"2026-11-06T21:45:07+00:00","note":null}],"documents":[{"id":90320,"url":"https://github.com/Bubka/2FAuth/commit/08753afbd847da8fa285e2ad857693ff88e46b84","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90321,"url":"https://github.com/Bubka/2FAuth/releases/tag/v8.0.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":90322,"url":"https://github.com/Bubka/2FAuth/security/advisories/GHSA-m52c-63g8-qg5c","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-01T21:32:01+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}