Threats tagged 'ghsa-rh3w-4ccx-prf9'

Admidio contains a logic error in its two-factor authentication (2FA) reset authorization check that allows non-admin users with profile edit rights on admin accounts to disable 2FA for those administrators. This occurs because the authorization condition is inverted, blocking non-admins from resetting their own 2FA but permitting them to reset others', including admins. The flaw is fixed in version 5.0.9.