CVE-2026-63437

Name of the Vulnerable Software and Affected Versions 2FAuth versions prior to 8.0.0

Description The recipients() function in the app/Api/v1/Controllers/TwoFAccountShareController.php file fails to invoke the manageShares authorization policy before listing recipients. When account sharing is enabled, an authenticated user can access the 'GET /api/v1/twofaccounts/{victimId}/recipients' endpoint to retrieve information about accounts owned by other users. This allows the attacker to enumerate registered user IDs and display names, verify specific email addresses using the filter[nameOrEmail] variable, and inspect sharing relationships for each account.

Recommendations Update to version 8.0.0.