CVE-2020-5240

Name of the Vulnerable Software and Affected Versions wagtail-2fa versions prior to 1.4.1

Description The issue allows any user with access to the CMS to view and delete other users' 2FA devices by going to the correct path, without requiring special permissions. By deleting another user's device, an attacker can disable the target user's 2FA devices and potentially compromise the account if they figure out the password.

Recommendations For versions prior to 1.4.1, update to version 1.4.1 to resolve the issue. As a temporary workaround, consider restricting access to the CMS to minimize the risk of exploitation.