id: PYSEC-2026-2326
published: "2026-07-13T14:36:32.990890Z"
modified: "2026-07-13T16:03:10.976275Z"
aliases:
- CVE-2024-51734
- GHSA-g5vw-3h65-2q3v
summary: Access control vulnerable to user data deletion by anonynmous users
details: "### Impact\nAnonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access.\n\n### Patches\nThe problem is fixed in version 7.2.\n\n### Workarounds\nThe problem can be fixed by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.\n\n### References\nhttps://github.com/zopefoundation/AccessControl/issues/159"
affected:
- package:
    name: accesscontrol
    ecosystem: PyPI
    purl: pkg:pypi/accesscontrol
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: "7.2"
  versions:
  - 2.13.0
  - 2.13.1
  - 2.13.10
  - 2.13.11
  - 2.13.12
  - 2.13.13
  - 2.13.14
  - 2.13.15
  - 2.13.16
  - 2.13.2
  - 2.13.3
  - 2.13.4
  - 2.13.5
  - 2.13.6
  - 2.13.7
  - 2.13.8
  - 2.13.9
  - "3.0"
  - 3.0.1
  - 3.0.10
  - 3.0.11
  - 3.0.12
  - 3.0.13
  - 3.0.14
  - 3.0.2
  - 3.0.3
  - 3.0.4
  - 3.0.5
  - 3.0.6
  - 3.0.7
  - 3.0.8
  - 3.0.9
  - "4.0"
  - 4.0a1
  - 4.0a2
  - 4.0a3
  - 4.0a4
  - 4.0a5
  - 4.0a6
  - 4.0a7
  - 4.0b1
  - 4.0b2
  - 4.0b3
  - 4.0b4
  - 4.0b5
  - 4.0b6
  - 4.0b7
  - "4.1"
  - "4.2"
  - "4.3"
  - "4.4"
  - "5.0"
  - "5.1"
  - "5.2"
  - "5.3"
  - 5.3.1
  - "5.4"
  - "5.5"
  - "5.6"
  - "5.7"
  - "6.0"
  - "6.1"
  - "6.2"
  - "6.3"
  - "7.0"
  - "7.1"
references:
- type: WEB
  url: https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-g5vw-3h65-2q3v
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2024-51734
- type: WEB
  url: https://github.com/zopefoundation/AccessControl/issues/159
- type: PACKAGE
  url: https://github.com/zopefoundation/AccessControl
- type: PACKAGE
  url: https://pypi.org/project/accesscontrol
- type: ADVISORY
  url: https://github.com/advisories/GHSA-g5vw-3h65-2q3v
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- type: CVSS_V4
  score: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U