Start for Free
CRITICAL 9.1 PyPI

Access control vulnerable to user data deletion by anonynmous users

GHSA-g5vw-3h65-2q3v · CVE-2024-51734 · PYSEC-2026-2076 · PYSEC-2026-2326

Published · Modified

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Impact

Anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access.

Patches

The problem is fixed in version 7.2.

Workarounds

The problem can be fixed by adding data__roles__ = () to AccessControl.userfolder.UserFolder.

References

https://github.com/zopefoundation/AccessControl/issues/159

References

More PyPI vulnerabilities

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes