Nextcloud · Report #1200989
No admin audit entry for enabling/disabling 2FA
Informativestatus
lowseverity
4upvotes
16 Jun 2021disclosed
How it was found
Related to https://hackerone.com/reports/1177353 When a user enables or disables 2FA there is no entry in the audit log.
Impact
Especially for disabling it should probably be logged there. But account security related things should be in there.