CVE-2020-7941
Plone Unauthenticated Write Vulnerability
CVE-2020-7941 is a critical vulnerability (CVSS 9.8) in Plone, published January 23, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.27%, the 83rd percentile. Fixed in plone-app-contenttypes 2.1.6.
A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.
- Record
CVE-2020-7941- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.
- Record
CVE-2020-7941- Updated
- 2026-11-02
EUVDEUVD-2020-0148 No score
A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.
- Record
EUVD-2020-0148- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w6g9-xccc-347h
Plone Unauthenticated Write Vulnerability
A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.
- Record
GHSA-w6g9-xccc-347h- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-269
- Updated
- 2026-11-02
OSV
A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.
- Record
CVE-2020-7941- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-w6g9-xccc-347h
Plone Unauthenticated Write Vulnerability
A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.
- Record
GHSA-w6g9-xccc-347h- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-269
- Updated
- 2026-11-02
OSVPYSEC-2026-459
Plone Unauthenticated Write Vulnerability
A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.
- Record
PYSEC-2026-459- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVPYSEC-2020-90 No score
A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.
- Record
PYSEC-2020-90- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
plonePyPI |
4.3 to 5.2.1 | None known |
plone-app-contenttypesPyPI |
before 2.1.6 | 2.1.6 |
plonePyPI |
4.3 to 5.2.1, plus listed versions 4.3.14.3.104.3.114.3.124.3.13 Show 45 moreShow less4.3.144.3.154.3.164.3.174.3.184.3.194.3.24.3.204.3.34.3.44.3.54.3.64.3.74.3.84.3.95.05.0.15.0.105.0.25.0.35.0.45.0.55.0.65.0.75.0.85.0.95.0a15.0a25.0a35.0b15.0b25.0b35.0b45.0rc15.0rc25.0rc35.1.05.1.15.1.25.1.35.1.45.1.55.1.65.1.75.1a1 |
None known |
plone-app-contenttypesPyPI |
All versions, plus listed versions 1.01.0b11.0b21.0rc11.1 Show 45 moreShow less1.1.11.1.21.1.31.1.41.1.51.1.61.1.71.1.81.1.91.1a11.1b11.1b21.1b31.1b41.1b51.1b61.2.01.2.11.2.101.2.111.2.121.2.131.2.141.2.151.2.161.2.171.2.181.2.191.2.21.2.201.2.211.2.221.2.231.2.241.2.251.2.261.2.271.2.31.2.41.2.51.2.61.2.71.2.81.2.91.2a1 |
None known |
plonePyPI |
4.3 up to 5.2.2, plus listed versions 4.3.14.3.24.3.34.3.44.3.5 Show 45 moreShow less4.3.64.3.74.3.84.3.94.3.104.3.114.3.124.3.134.3.144.3.154.3.164.3.174.3.184.3.194.3.205.0a15.0a25.0a35.0b15.0b25.0b35.0b45.0rc15.0rc25.0rc35.05.0.15.0.25.0.35.0.45.0.55.0.65.0.75.0.85.0.95.0.105.1a15.1a25.1b15.1b25.1b35.1b45.1rc15.1rc25.1.0 |
5.2.2 |
plone-app-contenttypesPyPI |
before 2.1.6, plus listed versions 1.01.0b11.0b21.0rc11.1 Show 45 moreShow less1.1.11.1.21.1.31.1.41.1.51.1.61.1.71.1.81.1.91.1a11.1b11.1b21.1b31.1b41.1b51.1b61.2.01.2.11.2.101.2.111.2.121.2.131.2.141.2.151.2.161.2.171.2.181.2.191.2.21.2.201.2.211.2.221.2.231.2.241.2.251.2.261.2.271.2.31.2.41.2.51.2.61.2.71.2.81.2.91.2a1 |
2.1.6 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
plone.org/security/hotfix/20200121
openwall.com/lists/oss-security/2020/01/22/1
nvd.nist.gov/vuln/detail/CVE-2020-7941
github.com/plone/plone.app.contenttypes/blob/master/CHANGES.rst?plain=1
Left out here: 176 versions. The JSON record has them.