/user/<xyz>/2factor Access Denied

[ww9rivers]

Got "Access Denied" and "You seem to have stumbled upon a page that you do not have access to." when different user accessed my NodeBB 3.7.2 site.

In one case, it is a user in the "Global Moderator" group, on which I just turned on enforced 2FA, but the user does not have 2FA set up yet. That user seems to be forced to visit /user//2factor no matter what the route is.

Another case is a user not in any group but does have 2FA set up. In this case, user2 can log in, and browse around. Just /user//2factor would give an Access Denied.