CVE-2024-51734

User data deletion by anoynmous users in Zope

8.7 HighFix available

Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to upgrade. Users unable to upgrade may address the issue by adding data__roles__ = () to AccessControl.userfolder.UserFolder.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

0.43%Up 0.4 points since Nov 5, 2024

What each source reports

CVE List Score used 8.7

User data deletion by anoynmous users in Zope

Record: CVE-2024-51734
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-284
Updated: 2026-11-02

EUVDEUVD-2024-3250 8.7

Record: EUVD-2024-3250
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-g5vw-3h65-2q3v 6.6

Access control vulnerable to user data deletion by anonynmous users

Impact

Anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access.

Patches

The problem is fixed in version 7.2.

Workarounds

The problem can be fixed by adding data__roles__ = () to AccessControl.userfolder.UserFolder.

References

https://github.com/zopefoundation/AccessControl/issues/159

Record: GHSA-g5vw-3h65-2q3v
CVSS 4.0: 6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weakness: CWE-269, CWE-284
Updated: 2026-11-02

NVD 8.7

Record: CVE-2024-51734
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-284
Updated: 2026-11-02

OSV 8.7

User data deletion by anoynmous users in Zope

Record: CVE-2024-51734
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-284
Updated: 2026-11-02

OSVGHSA-g5vw-3h65-2q3v 6.6

Access control vulnerable to user data deletion by anonynmous users

Impact

Anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access.

Patches

The problem is fixed in version 7.2.

Workarounds

The problem can be fixed by adding data__roles__ = () to AccessControl.userfolder.UserFolder.

References

https://github.com/zopefoundation/AccessControl/issues/159

Record: GHSA-g5vw-3h65-2q3v
CVSS 4.0: 6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weakness: CWE-269, CWE-284
Updated: 2026-11-02

OSVPYSEC-2026-2076 6.6

Access control vulnerable to user data deletion by anonynmous users

Impact

Anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access.

Patches

The problem is fixed in version 7.2.

Workarounds

The problem can be fixed by adding data__roles__ = () to AccessControl.userfolder.UserFolder.

References

https://github.com/zopefoundation/AccessControl/issues/159

Record: PYSEC-2026-2076
CVSS 4.0: 6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated: 2026-11-02

OSVPYSEC-2026-2326 6.6

Access control vulnerable to user data deletion by anonynmous users

Impact

Anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access.

Patches

The problem is fixed in version 7.2.

Workarounds

The problem can be fixed by adding data__roles__ = () to AccessControl.userfolder.UserFolder.

References

https://github.com/zopefoundation/AccessControl/issues/159

Record: PYSEC-2026-2326
CVSS 4.0: 6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`accesscontrol` PyPI	before 7.2	7.2
`zope` PyPI	before 5.11.1	5.11.1
`accesscontrol` PyPI	before 7.2, plus listed versions 2.13.02.13.12.13.102.13.112.13.12 Show 45 moreShow less 2.13.132.13.142.13.152.13.162.13.22.13.32.13.42.13.52.13.62.13.72.13.82.13.93.03.0.13.0.103.0.113.0.123.0.133.0.143.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.94.04.0a14.0a24.0a34.0a44.0a54.0a64.0a74.0b14.0b24.0b34.0b44.0b54.0b64.0b74.14.24.3	7.2
`zope` PyPI	before 5.11.1, plus listed versions 4.04.0b14.0b104.0b24.0b3 Show 45 moreShow less 4.0b44.0b54.0b64.0b74.0b84.0b94.14.1.14.1.24.1.34.24.2.14.34.44.4.14.4.24.4.34.4.44.54.5.14.5.24.5.34.5.44.5.54.64.6.14.6.24.6.34.74.84.8.14.8.104.8.114.8.24.8.34.8.44.8.54.8.64.8.74.8.84.8.95.05.0a15.0a25.1	5.11.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-51734 is a high vulnerability (CVSS 8.7) in Zope Accesscontrol, published November 4, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in accesscontrol 7.2.

References

This page doesn't list everything

Left out here: 40 versions. The JSON record has them.