Unauthenticated users can list Plone site users and groups
Original title: Plone security fix 20261022: information disclosure
The October 22 fix covers sites with the Plone REST API enabled; results include user ids and full names.
The Plone/Zope Security Team announced an information-disclosure fix on October 22. An unauthenticated user can list a site's users and groups, including user ids and full names, when the Plone REST API is enabled. The advisory is GHSA-vhwp-qc29-j4xp. The feed text ends before naming affected or fixed versions.
Unconfirmed: The snippet is cut off, so affected versions and the full scope are not stated.
- Maurits van Rees posted the notice for the Plone/Zope Security Team.
- The advisory identifier is GHSA-vhwp-qc29-j4xp.
- Returned data includes each user's id and full name.
- The described impact is limited to sites with the Plone REST API enabled.
Impact: unauthenticated listing of user ids and full names
| Product | Affected |
|---|---|
| Plone | — |
- 1.Apply the October 22 Plone security fix on sites with the REST API enabled.
- Vendors
- Plone
- Products
- Plone REST API
- Organizations
- Plone/Zope Security Team
From the original article
Posted by Maurits van Rees (Plone) on Oct 22 On behalf of the Plone/Zope Security Team I announce an information https://github. com/plone/plone. app.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.