Plone hotfix 20261110 addresses remote code execution
Supported Plone 6.0, 6.1 and 6.2 are affected; the forwarded notice is cut off after older versions.
58
- Mentions · 7d1
- Mentions · 30d2
- All mentions2
- First seenOct 22, 2026
- Last mentioned17h ago
Timeline
2 articles · newest firstUnauthenticated users can list Plone site users and groups
The October 22 fix covers sites with the Plone REST API enabled; results include user ids and full names.
48
Appears with
- Plone/Zope Security Teamorganization · 1
- Plone REST APIproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.