{"id":"CVE-2024-51734","aliases":["EUVD-2024-3250","GHSA-g5vw-3h65-2q3v","PYSEC-2026-2076","PYSEC-2026-2326"],"status":"published","title":"User data deletion by anoynmous users in Zope","description":"Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to upgrade. Users unable to upgrade may address the issue by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00434,"percentile":0.38089,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269","CWE-284"],"published":"2024-11-04T22:25:22Z","modified":"2026-10-28T02:30:48Z","fixes":[{"ecosystem":"PyPI","package":"accesscontrol","fixed_in":["7.2"],"sources":["ghsa","osv"]},{"ecosystem":"PyPI","package":"zope","fixed_in":["5.11.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"accesscontrol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"zope","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.11.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"accesscontrol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2"}]}],"versions":["2.13.0","2.13.1","2.13.10","2.13.11","2.13.12","2.13.13","2.13.14","2.13.15","2.13.16","2.13.2","2.13.3","2.13.4","2.13.5","2.13.6","2.13.7","2.13.8","2.13.9","3.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","4.0","4.0a1","4.0a2","4.0a3","4.0a4","4.0a5","4.0a6","4.0a7","4.0b1","4.0b2","4.0b3","4.0b4","4.0b5","4.0b6","4.0b7","4.1","4.2","4.3","4.4","5.0","5.1","5.2","5.3","5.3.1","5.4","5.5","5.6","5.7","6.0","6.1","6.2","6.3","7.0","7.1"]},{"source":"osv","ecosystem":"PyPI","package":"zope","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.11.1"}]}],"versions":["4.0","4.0b1","4.0b10","4.0b2","4.0b3","4.0b4","4.0b5","4.0b6","4.0b7","4.0b8","4.0b9","4.1","4.1.1","4.1.2","4.1.3","4.2","4.2.1","4.3","4.4","4.4.1","4.4.2","4.4.3","4.4.4","4.5","4.5.1","4.5.2","4.5.3","4.5.4","4.5.5","4.6","4.6.1","4.6.2","4.6.3","4.7","4.8","4.8.1","4.8.10","4.8.11","4.8.2","4.8.3","4.8.4","4.8.5","4.8.6","4.8.7","4.8.8","4.8.9","5.0","5.0a1","5.0a2","5.1","5.1.1","5.1.2","5.10","5.11","5.2","5.2.1","5.3","5.4","5.5","5.5.1","5.5.2","5.6","5.7","5.7.1","5.7.2","5.7.3","5.8","5.8.1","5.8.2","5.8.3","5.8.4","5.8.5","5.8.6","5.9"]},{"source":"osv","ecosystem":"PyPI","package":"zope","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.11.1"}]}],"versions":["4.0","4.0b1","4.0b10","4.0b2","4.0b3","4.0b4","4.0b5","4.0b6","4.0b7","4.0b8","4.0b9","4.1","4.1.1","4.1.2","4.1.3","4.2","4.2.1","4.3","4.4","4.4.1","4.4.2","4.4.3","4.4.4","4.5","4.5.1","4.5.2","4.5.3","4.5.4","4.5.5","4.6","4.6.1","4.6.2","4.6.3","4.7","4.8","4.8.1","4.8.10","4.8.11","4.8.2","4.8.3","4.8.4","4.8.5","4.8.6","4.8.7","4.8.8","4.8.9","5.0","5.0a1","5.0a2","5.1","5.1.1","5.1.2","5.10","5.11","5.2","5.2.1","5.3","5.4","5.5","5.5.1","5.5.2","5.6","5.7","5.7.1","5.7.2","5.7.3","5.8","5.8.1","5.8.2","5.8.3","5.8.4","5.8.5","5.8.6","5.9"]},{"source":"osv","ecosystem":"PyPI","package":"accesscontrol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2"}]}],"versions":["2.13.0","2.13.1","2.13.10","2.13.11","2.13.12","2.13.13","2.13.14","2.13.15","2.13.16","2.13.2","2.13.3","2.13.4","2.13.5","2.13.6","2.13.7","2.13.8","2.13.9","3.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","4.0","4.0a1","4.0a2","4.0a3","4.0a4","4.0a5","4.0a6","4.0a7","4.0b1","4.0b2","4.0b3","4.0b4","4.0b5","4.0b6","4.0b7","4.1","4.2","4.3","4.4","5.0","5.1","5.2","5.3","5.3.1","5.4","5.5","5.6","5.7","6.0","6.1","6.2","6.3","7.0","7.1"]}],"products":[{"vendor":"zope","product":"accesscontrol"},{"vendor":"zopefoundation","product":"accesscontrol"}],"references":[{"url":"https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-g5vw-3h65-2q3v","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/zopefoundation/AccessControl/issues/159","tags":["x_refsource_MISC","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-51734","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g5vw-3h65-2q3v","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51734.json","tags":["advisory"]},{"url":"https://github.com/zopefoundation/AccessControl","tags":["package"]},{"url":"https://pypi.org/project/zope","tags":["package"]},{"url":"https://pypi.org/project/accesscontrol","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-51734","title":"User data deletion by anoynmous users in Zope","description":"Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to upgrade. Users unable to upgrade may address the issue by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.","status":"published","published":"2024-11-04T22:25:22.076Z","modified":"2025-01-22T20:12:19.451Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:34:01.972857Z"}],"euvd":[{"id":"EUVD-2024-3250","description":"Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to upgrade. Users unable to upgrade may address the issue by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.","status":"published","published":"2024-11-04T22:25:22Z","modified":"2025-01-22T20:12:19Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-03T00:04:15.37855Z"}],"ghsa":[{"id":"GHSA-g5vw-3h65-2q3v","title":"Access control vulnerable to user data deletion by anonynmous users","description":"### Impact\nAnonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access.\n\n### Patches\nThe problem is fixed in version 7.2.\n\n### Workarounds\nThe problem can be fixed by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.\n\n### References\nhttps://github.com/zopefoundation/AccessControl/issues/159","status":"published","published":"2024-11-04T23:23:35Z","modified":"2024-11-07T09:16:38Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"cwes":["CWE-269","CWE-284"],"updated_at":"2026-11-02T14:38:16.477822Z"}],"nvd":[{"id":"CVE-2024-51734","description":"Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to upgrade. Users unable to upgrade may address the issue by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.","status":"published","published":"2024-11-04T23:15:05.213Z","modified":"2026-06-17T08:06:13.08Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:10:35.864552Z"}],"osv":[{"id":"CVE-2024-51734","title":"User data deletion by anoynmous users in Zope","description":"Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to upgrade. Users unable to upgrade may address the issue by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.","status":"published","published":"2024-11-04T22:25:22.076Z","modified":"2026-10-28T02:30:48.906910833Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:44:44.032344Z"},{"id":"GHSA-g5vw-3h65-2q3v","title":"Access control vulnerable to user data deletion by anonynmous users","description":"### Impact\nAnonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access.\n\n### Patches\nThe problem is fixed in version 7.2.\n\n### Workarounds\nThe problem can be fixed by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.\n\n### References\nhttps://github.com/zopefoundation/AccessControl/issues/159","status":"published","published":"2024-11-04T23:23:35Z","modified":"2026-07-13T16:43:09.124567216Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"},{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-269","CWE-284"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"PYSEC-2026-2076","title":"Access control vulnerable to user data deletion by anonynmous users","description":"### Impact\nAnonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access.\n\n### Patches\nThe problem is fixed in version 7.2.\n\n### Workarounds\nThe problem can be fixed by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.\n\n### References\nhttps://github.com/zopefoundation/AccessControl/issues/159","status":"published","published":"2026-07-07T14:34:43.747557Z","modified":"2026-07-13T16:43:09.124567216Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"},{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"PYSEC-2026-2326","title":"Access control vulnerable to user data deletion by anonynmous users","description":"### Impact\nAnonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access.\n\n### Patches\nThe problem is fixed in version 7.2.\n\n### Workarounds\nThe problem can be fixed by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.\n\n### References\nhttps://github.com/zopefoundation/AccessControl/issues/159","status":"published","published":"2026-07-13T14:36:32.99089Z","modified":"2026-07-13T16:43:09.124567216Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"},{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"}],"updated_at":"2026-11-02T15:52:55.537808Z"}]}}