CRITICAL9.8
PYSEC-2026-459
Plone Unauthenticated Write Vulnerability
Quick fix
PYSEC-2026-459 — plone-app-contenttypes: upgrade to the fixed version with the command below.
pip install --upgrade 'plone-app-contenttypes>=2.1.6'Details
A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI/plone-app-contenttypes
Introduced in:
0Fixed in: 2.1.6Fix
pip install --upgrade 'plone-app-contenttypes>=2.1.6'References
- https://nvd.nist.gov/vuln/detail/CVE-2020-7941[ADVISORY]
- https://github.com/plone/plone.app.contenttypes[PACKAGE]
- https://github.com/plone/plone.app.contenttypes/blob/master/CHANGES.rst?plain=1#L372-L374[WEB]
- https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-90.yaml[WEB]
- https://plone.org/security/hotfix/20200121[WEB]
- https://plone.org/security/hotfix/20200121/privilege-escalation-for-overwriting-content[WEB]
- https://www.openwall.com/lists/oss-security/2020/01/22/1[WEB]
- http://www.openwall.com/lists/oss-security/2020/01/24/1[WEB]
- https://pypi.org/project/plone-app-contenttypes[PACKAGE]
- https://github.com/advisories/GHSA-w6g9-xccc-347h[ADVISORY]