2FA Can Be Removed Without a Security Check

[ZaxLofful]

Description

A User is able to remove 2FA without an additional security check.

Standard practice here dictates that, if the user has 2FA already enabled; they should not be able to disable it without a 2FA check.

This would mean someone could have 2FA disabled, just by leaving their browser open for a few seconds.

This is for an admin account, in the event of a loss; recovery keys will need to be used.

Gitea Version

1.20

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

Podman

Database

PostgreSQL

[codenoid]

should it cofirm by entering the account password?

[lunny]

I think when you login, you have been prompt 2FA? So the problem should be if 2FA enabled/disabled, all login sessions should be invalidated except current one.

[ZaxLofful]

Account password or a recovery code...