Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API.
"https://github.com/pypa/advisory-database/blob/main/vulns/plone/PYSEC-2014-66.yaml"