{"id":"CVE-2024-51734","aliases":["GHSA-g5vw-3h65-2q3v","PYSEC-2026-2076","PYSEC-2026-2326"],"url":"https://o3.security/vulnerability/CVE-2024-51734","summary":"User data deletion by anoynmous users in Zope","details":"Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to upgrade. Users unable to upgrade may address the issue by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.","published":"2024-11-04T22:25:22.076Z","modified":"2026-08-12T03:51:45.180044174Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"accesscontrol","fixedVersion":"7.2"},{"ecosystem":"PyPI","name":"zope","fixedVersion":"5.11.1"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51734.json"},{"type":"ADVISORY","url":"https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-g5vw-3h65-2q3v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-51734"},{"type":"REPORT","url":"https://github.com/zopefoundation/AccessControl/issues/159"},{"type":"PACKAGE","url":"https://github.com/zopefoundation/AccessControl"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:45.180044174Z"}}