Read the docs
TI-2024-34640 Aliases CVE-2024-51734GHSA-g5vw-3h65-2q3v

User data deletion by anoynmous users in Zope

Priority MEDIUM 44CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass, Privilege escalation
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284 and CWE-269.

Summary

Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to upgrade. Users unable to upgrade may address the issue by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00434 37th percentileScored 2026-11-07
Fix Fixed AccessControl (PyPI): 7.2Zope (PyPI): 5.11.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zopefoundationAccessControlZope AccessControl: < 7.2; Zope bundle: < 5.11.1—No fix listedCNA
—AccessControl (PyPI)before 7.27.2Patch availableGHSA-g5vw-3h65-2q3v
—Zope (PyPI)before 5.11.15.11.1Patch availableGHSA-g5vw-3h65-2q3v
  • AccessControl Vendorzopefoundation Affected Zope AccessControl: < 7.2; Zope bundle: < 5.11.1 Fixed in — No fix listed CNA
  • AccessControl (PyPI) Vendor— Affected before 7.2 Fixed in 7.2 Patch available GHSA-g5vw-3h65-2q3v
  • Zope (PyPI) Vendor— Affected before 5.11.1 Fixed in 5.11.1 Patch available GHSA-g5vw-3h65-2q3v

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:zope:accesscontrol:*:*:*:*:*:*:*:*——zopefoundation
  • cpe:2.3:a:zope:accesscontrol:*:*:*:*:*:*:*:* Versions — — ·zopefoundation

Remediation

  • Fix · GHSA-g5vw-3h65-2q3v AccessControl (PyPI) Fixed in 7.2 Advisory →
  • Fix · GHSA-g5vw-3h65-2q3v Zope (PyPI) Fixed in 5.11.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-51734
  2. 2026-10-03 Alias added: GHSA-g5vw-3h65-2q3v

References

Advisory 1

Other 3

  • TI-2011-03162 Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through… CVSS 2.0HIGH 9.3
  • TI-2026-40297 RestrictedPython guard hooks can be shadowed via positional-only arguments CVSS 3.1HIGH 8.3
  • TI-2024-16328 Products.SQLAlchemyDA vulnerable to unauthenticated arbitrary SQL query execution CVSS 3.1CRITICAL 9.8
  • TI-2000-00062 The DTML implementation in the Z Object Publishing Environment (Zope) allows remote… CVSS 2.0HIGH 10.0
  • TI-2024-31821 RestrictedPython information leakage via `AttributeError.obj` and the `string` module CVSS 4.0HIGH 8.7
  • TI-2023-18901 RestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escape CVSS 3.1CRITICAL 9.9
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences