CVE-2020-5240: Vulnerability in wagtail-2fa Allows Unauthorized Access to and Deletion of 2FA Devices
Summary
CVE-2020-5240: In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. Affects wagtail-2fa across 2 version ranges.
< 1.4.1
< ac23550d33b7436e90e3beea904647907eba5b74
Fixed in ac23550d33b7436e90e3beea904647907eba5b74. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
wagtail-2fa is a package available on PyPI that provides two-factor authentication (2FA) functionality for the Wagtail CMS. It allows users to add an extra layer of security to their Wagtail CMS accounts by requiring a second form of authentication, such as a time-based one-time password (TOTP) or a hardware token. This package is widely used by Wagtail CMS users to enhance the security of their accounts.
Vulnerability Detail
In versions of wagtail-2fa before 1.4.1, a vulnerability exists that allows any user with access to the CMS to view and delete other users' 2FA devices. This vulnerability can be exploited by navigating to a specific path within the CMS, without requiring any special permissions. By deleting another user's 2FA device, an attacker can disable their 2FA protection and potentially compromise their account if they can also obtain their password. The vulnerability has been assigned CVE-2020-5240 and has been patched in version 1.4.1 of the wagtail-2fa package.
How To Fix
Latest published version: 1.8.0 as of 22 Oct 2026
pip install --upgrade "wagtail-2fa==1.8.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
ac23550d33b7436e90e3beea904647907eba5b74
This is the first release that contains the fix.
pip install --upgrade "wagtail-2fa==ac23550d33b7436e90e3beea904647907eba5b74"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the patched version as soon as possible to mitigate the risk.
Conclusion
The vulnerability in wagtail-2fa allows unauthorized access to and deletion of 2FA devices, posing a risk to the security of Wagtail CMS accounts. Users are advised to upgrade to version 1.4.1 or later of the wagtail-2fa package to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for wagtail-2fa →
FAQ
wagtail-2fa is a package that provides two-factor authentication functionality for the Wagtail CMS.
This vulnerability allows unauthorized users to view and delete other users' 2FA devices, potentially compromising their accounts.
To fix this vulnerability, upgrade to version 1.4.1 or later of the wagtail-2fa package.
There is no known workaround for this vulnerability. It is recommended to upgrade to the patched version.
More information about this vulnerability can be found in the advisory database of the Python Package Index (PyPI).
References
Related vulnerabilities
Recent vulnerabilities recorded for wagtail-2fa.
