1 results (0.001 seconds)

CVSS: 8.7EPSS: 0%CPEs: 2EXPL: 0

Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to upgrade. Users unable to upgrade may address the issue by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`. • https://github.com/zopefoundation/AccessControl/issues/159 https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-g5vw-3h65-2q3v • CWE-284: Improper Access Control •