{"id":"PYSEC-2026-2326","summary":"Access control vulnerable to user data deletion by anonynmous users","details":"### Impact\nAnonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access.\n\n### Patches\nThe problem is fixed in version 7.2.\n\n### Workarounds\nThe problem can be fixed by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.\n\n### References\nhttps://github.com/zopefoundation/AccessControl/issues/159","aliases":["CVE-2024-51734","GHSA-g5vw-3h65-2q3v","PYSEC-2026-2076"],"modified":"2026-07-13T16:43:09.124567216Z","published":"2026-07-13T14:36:32.990890Z","references":[{"type":"WEB","url":"https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-g5vw-3h65-2q3v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-51734"},{"type":"WEB","url":"https://github.com/zopefoundation/AccessControl/issues/159"},{"type":"PACKAGE","url":"https://github.com/zopefoundation/AccessControl"},{"type":"PACKAGE","url":"https://pypi.org/project/accesscontrol"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-g5vw-3h65-2q3v"}],"affected":[{"package":{"name":"accesscontrol","ecosystem":"PyPI","purl":"pkg:pypi/accesscontrol"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2"}]}],"versions":["2.13.0","2.13.1","2.13.10","2.13.11","2.13.12","2.13.13","2.13.14","2.13.15","2.13.16","2.13.2","2.13.3","2.13.4","2.13.5","2.13.6","2.13.7","2.13.8","2.13.9","3.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","4.0","4.0a1","4.0a2","4.0a3","4.0a4","4.0a5","4.0a6","4.0a7","4.0b1","4.0b2","4.0b3","4.0b4","4.0b5","4.0b6","4.0b7","4.1","4.2","4.3","4.4","5.0","5.1","5.2","5.3","5.3.1","5.4","5.5","5.6","5.7","6.0","6.1","6.2","6.3","7.0","7.1"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/accesscontrol/PYSEC-2026-2326.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"}]}