MEDIUM6.5
PYSEC-2026-2888
Plone and plone.app.users allow remote authenticated users to modify the properties of arbitrary accounts
Quick fix
PYSEC-2026-2888 — plone-app-users: upgrade to the fixed version with the command below.
pip install --upgrade 'plone-app-users>=1.0.5'Details
plone.app.users in Plone 4.0 and 4.1 allows remote authenticated users to modify the properties of arbitrary accounts via unspecified vectors, as exploited in the wild in June 2011.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI/plone-app-users
Introduced in:
1.0a1Fixed in: 1.0.5Fix
pip install --upgrade 'plone-app-users>=1.0.5'References
- https://nvd.nist.gov/vuln/detail/CVE-2011-1950[ADVISORY]
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67695[WEB]
- https://github.com/advisories/GHSA-2qx8-589j-gcpx[ADVISORY]
- https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2011-16.yaml[WEB]
- http://plone.org/products/plone/security/advisories/CVE-2011-1950[WEB]
- https://pypi.org/project/plone-app-users[PACKAGE]