Lodos2005

**Name of the Vulnerable Software and Affected Versions** Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection versions prior to 1.4.0 **Description** An issue exists where a REST API endpoint fails to perform a capability check. This allows unauthenticated attackers to retrieve a complete list of registered users, including their usernames, email addresses, roles, and two-factor authentication enrollment status, via the '/2fa/app/users' endpoint. **Recommendations** Update to version 1.4.0 or later. Restrict access to the '/2fa/app/users' endpoint as a temporary mitigation measure.