CVE-2020-5240 json
2FA bypass through deleting devices in wagtail-2fa
published 2020-03-13 6 y ago modified 2026-09-10 1 mo ago also GHSA-9gjv-6qq6-v7qm , PYSEC-2020-219 , EUVD-2020-0234
- cvss
- 7.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 0
- none known
Summary
In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially compromise the account if they figure out their password. The problem has been patched in version 1.4.1.
Patch / fix
Exploit prediction
1.00% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N |
| NVD | 3.1 | 8.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N |
| NVD | 2.0 | 5.5 | AV:N/AC:L/Au:S/C:P/I:P/A:N |
| GitHub | 3.1 | 7.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | wagtail-2fa | <1.4.1 |
1.4.1 |
Affected products
- Lab Digital wagtail-2fa
Classification
References
-
github.com
/labd/wagtail-2fa/commit/ac23550d33b7436e90e3beea904647907eba5b74
web, patch, third-party-advisory
-
github.com
/labd/wagtail-2fa/security/advisories/GHSA-9gjv-6qq6-v7qm
web, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-5240
advisory
-
github.com
/labd/wagtail-2fa
package
-
github.com
/pypa/advisory-database/tree/main/vulns/wagtail-2fa/PYSEC-2020-219.yaml
web
Sources
- CVE List CVE-2020-5240
- GitHub Advisory GHSA-9gjv-6qq6-v7qm
- NVD CVE-2020-5240
- OSV PYSEC-2020-219
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.