CVE-2025-7030

Description

Privilege Defined With Unsafe Actions vulnerability in Drupal Two-factor Authentication (TFA) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.11.0.

PUBLISHED Reserved 2025-07-02 | Published 2025-07-08 | Updated 2025-07-09 | Assigner drupal

Problem types

CWE-267 Privilege Defined With Unsafe Actions

Product status

Credits

Conrad Lara (cmlara) finder

Conrad Lara (cmlara) remediation developer

cilefen (cilefen) coordinator

Dan Smith (galooph) coordinator

Greg Knaddison (greggles) coordinator

Jess (xjm) coordinator

References

www.drupal.org/sa-contrib-2025-085

cve.org (CVE-2025-7030)

nvd.nist.gov (CVE-2025-7030)

Download JSON