Description
A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | plone | >= 4.3, <= 5.2.1 | — | GHSA-w6g9-xccc-347h |
| PyPI | plone | >= 4.3, < 5.2.2 | 5.2.2 | PYSEC-2020-90 |
| PyPI | plone-app-contenttypes | all versions | — | GHSA-w6g9-xccc-347h |
| PyPI | plone-app-contenttypes | < 2.1.6 | 2.1.6 | PYSEC-2026-459 |