Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates.
{
"versions": [
{
"introduced": "0"
},
{
"last_affected": "5.0"
},
{
"introduced": "0"
},
{
"last_affected": "5.0-rc1"
},
{
"introduced": "0"
},
{
"last_affected": "5.0-rc2"
},
{
"introduced": "0"
},
{
"last_affected": "5.0-rc3"
},
{
"introduced": "0"
},
{
"last_affected": "5.0.1"
},
{
"introduced": "0"
},
{
"last_affected": "5.0.2"
},
{
"introduced": "0"
},
{
"last_affected": "5.0.3"
},
{
"introduced": "0"
},
{
"last_affected": "5.0.4"
},
{
"introduced": "0"
},
{
"last_affected": "5.1a1"
}
]
}