CVE-2024-51734: Zope Accesscontrol

High severity, CVSS 8.7. EPSS: 0.4% chance of exploitation in the next 30 days.

Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to upgrade. Users unable to upgrade may address the issue by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.

Affected products

• Zope Accesscontrol: before 7.2 (fixed in 7.2); before 5.11.1 (fixed in 5.11.1)
• Zopefoundation Accesscontrol

Published 2024-11-04. Last modified 2026-06-17.