{"id":"CVE-2020-5240","aliases":["GHSA-9gjv-6qq6-v7qm","PYSEC-2020-219"],"title":"2FA bypass through deleting devices in wagtail-2fa","summary":"2FA bypass through deleting devices in wagtail-2fa","severity":"high","cvss":7.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N","vendor":"wagtail-2fa","product":"wagtail-2fa","ecosystem":"pip","affected":["wagtail-2fa < 1.4.1"],"patched":["wagtail-2fa 1.4.1"],"published":"2020-03-13","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:48:29.719471847Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-9gjv-6qq6-v7qm","references":[{"url":"https://github.com/labd/wagtail-2fa/security/advisories/GHSA-9gjv-6qq6-v7qm"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5240"},{"url":"https://github.com/labd/wagtail-2fa/commit/ac23550d33b7436e90e3beea904647907eba5b74"},{"url":"https://github.com/labd/wagtail-2fa"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/wagtail-2fa/PYSEC-2020-219.yaml"}],"tags":["osv","pip"],"epss":0.0098,"epssPercentile":0.60205,"ingestedAt":"2026-09-12T03:13:01.683Z","slug":"CVE-2020-5240","body":"## Overview\n\n### Impact\nAny user with access to the CMS can view and delete other users&#39; 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other user&#39;s device they can disable the target user&#39;s 2FA devices and potentially compromise the account if they figure out their password.\n\n### Patches\nThe problem has been patched in version 1.4.1.\n\n### Workarounds\nThere is no workaround for this issue.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [github.com/labd/wagtail-2fa](https://github.com/labd/wagtail-2fa)\n* Email us at [security@labdigital.nl](mailto:security@labdigital.nl)\n\n## Affected packages\n\n- `wagtail-2fa < 1.4.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `wagtail-2fa 1.4.1`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.8,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}