Unauthenticated users can list Plone site users and groups
The October 22 fix covers sites with the Plone REST API enabled; results include user ids and full names.
48
Organization
Plone/Zope Security Team
- Mentions · 7d0
- Mentions · 30d1
- All mentions1
- First seenOct 22, 2026
- Last mentioned19d ago
Timeline
1 articles · newest firstAppears with
- Plonevendor · 1
- Plone REST APIproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.