---
id: CVE-2024-51734
aliases:
  - GHSA-g5vw-3h65-2q3v
  - PYSEC-2026-2076
title: Access control vulnerable to user data deletion by anonynmous users
summary: Access control vulnerable to user data deletion by anonynmous users
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'
vendor: accesscontrol
product: accesscontrol
ecosystem: pip
affected:
  - accesscontrol < 7.2
  - zope < 5.11.1
patched:
  - accesscontrol 7.2
  - zope 5.11.1
published: '2024-11-04'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-g5vw-3h65-2q3v'
references:
  - url: >-
      https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-g5vw-3h65-2q3v
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-51734'
  - url: 'https://github.com/zopefoundation/AccessControl/issues/159'
  - url: 'https://github.com/zopefoundation/AccessControl'
tags:
  - osv
  - pip
epss: 0.00434
epssPercentile: 0.35039
ingestedAt: '2026-07-08T18:25:49.614Z'
---

## Overview

### Impact
Anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access.

### Patches
The problem is fixed in version 7.2.

### Workarounds
The problem can be fixed by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.

### References
https://github.com/zopefoundation/AccessControl/issues/159

## Affected packages

- `accesscontrol < 7.2`
- `zope < 5.11.1`

## Remediation

Upgrade to a patched release:

- `accesscontrol 7.2`
- `zope 5.11.1`