PYSEC-2026-2326
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/accesscontrol/PYSEC-2026-2326.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-2326
- Aliases
- Published
- 2026-07-13T14:36:32.990890Z
- Modified
- 2026-07-13T16:43:09.124567216Z
- Severity
-
- 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
- 6.6 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator
- Summary
- Access control vulnerable to user data deletion by anonynmous users
- Details
-
Impact
Anonymous users can delete the user data maintained by an
AccessControl.userfolder.UserFolderwhich may prevent any privileged access.Patches
The problem is fixed in version 7.2.
Workarounds
The problem can be fixed by adding
data__roles__ = ()toAccessControl.userfolder.UserFolder.References
https://github.com/zopefoundation/AccessControl/issues/159
- References
-
- https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-g5vw-3h65-2q3v
- https://nvd.nist.gov/vuln/detail/CVE-2024-51734
- https://github.com/zopefoundation/AccessControl/issues/159
- https://github.com/zopefoundation/AccessControl
- https://pypi.org/project/accesscontrol
- https://github.com/advisories/GHSA-g5vw-3h65-2q3v
Affected packages
PyPI / accesscontrol
Package
- Name
- accesscontrol
- View open source insights on deps.dev
- Purl
- pkg:pypi/accesscontrol
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed7.2
Affected versions
2.*
2.13.0
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13.6
2.13.7
2.13.8
2.13.9
2.13.10
2.13.11
2.13.12
2.13.13
2.13.14
2.13.15
2.13.16
3.*
3.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.0.10
3.0.11
3.0.12
3.0.13
3.0.14
4.*
4.0a1
4.0a2
4.0a3
4.0a4
4.0a5
4.0a6
4.0a7
4.0b1
4.0b2
4.0b3
4.0b4
4.0b5
4.0b6
4.0b7
4.0
4.1
4.2
4.3
4.4
5.*
5.0
5.1
5.2
5.3
5.3.1
5.4
5.5
5.6
5.7
6.*
6.0
6.1
6.2
6.3
7.*
7.0
7.1