Description
Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to upgrade. Users unable to upgrade may address the issue by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| zopefoundation | AccessControl | Zope AccessControl: < 7.2, Zope bundle: < 5.11.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | accesscontrol | < 7.2 | 7.2 | GHSA-g5vw-3h65-2q3v |
| PyPI | zope | < 5.11.1 | 5.11.1 | GHSA-g5vw-3h65-2q3v |