PYSEC-2026-2076
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/zope/PYSEC-2026-2076.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-2076
- Aliases
- Published
- 2026-07-07T14:34:43Z
- Modified
- 2026-07-13T16:43:09Z
- Severity
-
- 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
- 6.6 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator
- Summary
- Access control vulnerable to user data deletion by anonynmous users
- Details
-
Impact
Anonymous users can delete the user data maintained by an
AccessControl.userfolder.UserFolderwhich may prevent any privileged access.Patches
The problem is fixed in version 7.2.
Workarounds
The problem can be fixed by adding
data__roles__ = ()toAccessControl.userfolder.UserFolder.References
- References
-
- https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-g5vw-3h65-2q3v
- https://nvd.nist.gov/vuln/detail/CVE-2024-51734
- https://github.com/zopefoundation/AccessControl/issues/159
- https://github.com/zopefoundation/AccessControl
- https://pypi.org/project/zope
- https://github.com/advisories/GHSA-g5vw-3h65-2q3v
Affected packages
PyPI / zope
Package
- Name
- zope
- View open source insights on deps.dev
- Purl
- pkg:pypi/zope
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed5.11.1
Affected versions
4.*
4.0b1
4.0b2
4.0b3
4.0b4
4.0b5
4.0b6
4.0b7
4.0b8
4.0b9
4.0b10
4.0
4.1
4.1.1
4.1.2
4.1.3
4.2
4.2.1
4.3
4.4
4.4.1
4.4.2
4.4.3
4.4.4
4.5
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.6
4.6.1
4.6.2
4.6.3
4.7
4.8
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.8.10
4.8.11
5.*
5.0a1
5.0a2
5.0
5.1
5.1.1
5.1.2
5.2
5.2.1
5.3
5.4
5.5
5.5.1
5.5.2
5.6
5.7
5.7.1
5.7.2
5.7.3
5.8
5.8.1
5.8.2
5.8.3
5.8.4
5.8.5
5.8.6
5.9
5.10
5.11