GHSA-g5vw-3h65-2q3v
Access control vulnerable to user data deletion by anonynmous users
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | AccessControl | < 7.2 | 7.2 |
| PyPI | Zope | < 5.11.1 | 5.11.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access.
### Patches
The problem is fixed in version 7.2.
### Workarounds
The problem can be fixed by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.
### References
https://github.com/zopefoundation/AccessControl/issues/159
References
External links from the advisory. They lead to third-party sites.