CVE-2024-51734: 
Python vulnerability analysis and mitigation

Zope AccessControl provides a general security framework for use in Zope. In affected versions prior to 7.2, anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access (GitHub Advisory). The vulnerability was discovered in October 2024 and publicly disclosed on November 4, 2024.

The vulnerability exists due to unrestricted access to the UserFolder.data attribute (PersistentMapping -> UserDict). When accessing /acl_users/data/clear via HTTP without any privileges, the collections.UserDict.clear() method is executed, which deletes all users in the User Folder. The vulnerability has been assigned a CVSS score indicating high severity (CISA Bulletin).

The successful exploitation of this vulnerability allows anonymous users to delete all user data maintained by the AccessControl.userfolder.UserFolder. This can effectively prevent any privileged access to the system, as all user authentication data would be removed (GitHub Advisory).

The vulnerability has been patched in AccessControl version 7.2 and Zope version 5.11.1. As a workaround, administrators can add dataroles = () to AccessControl.userfolder.UserFolder to prevent unauthorized access (GitHub Advisory).