CVE-2024-51734: AccessControl Package Vulnerability Allows Anonymous User Data Deletion
Summary
CVE-2024-51734: Access control vulnerable to user data deletion by anonynmous users. Affects accesscontrol versions < 7.2. Fixed in 7.2. How to fix ↓
Also tracked for
- zope · PyPI
The same CVE-2024-51734 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The AccessControl package is a widely used library in Python that provides mechanisms for managing user permissions and access control in applications. It is integral to ensuring that only authorized users can perform certain actions, thereby safeguarding sensitive data. However, a recent vulnerability has been identified that allows anonymous users to delete user data, potentially compromising the integrity of the application and its user management.
Vulnerability Detail
The vulnerability arises from improper access control within the AccessControl.userfolder.UserFolder component. This flaw permits anonymous users to delete user data, which can lead to unauthorized access and loss of critical information. The implications of this vulnerability are significant, as it undermines the security model of applications relying on this package, allowing malicious actors to disrupt services and delete essential user data.
How To Fix
Latest published version: 7.5.0 as of 23 Oct 2026
pip install --upgrade "accesscontrol==7.5.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.2
This is the first release that contains the fix.
pip install --upgrade "accesscontrol==7.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
To implement a workaround, add the following line to the AccessControl.userfolder.UserFolder class: 'data__roles__ = ()'. This adjustment will help mitigate the risk until the package can be updated.
Conclusion
The vulnerability identified as CVE-2024-51734 poses a significant risk to applications using the AccessControl package, allowing unauthorized deletion of user data by anonymous users. It is crucial for developers to update to the patched version 7.2 or implement the provided workaround to mitigate this risk. Utilizing tools like Vulert can further enhance security monitoring.
See every vulnerability recorded for accesscontrol →
FAQ
CVE-2024-51734 is a vulnerability in the AccessControl package that allows anonymous users to delete user data, compromising application security.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The consequences include unauthorized data deletion, potential loss of user information, and a breach of the application's security model.
Yes, the vulnerability is fixed in version 7.2 of the AccessControl package. Users should update to this version to ensure security.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using the Pipfile.lock. It helps developers stay informed about potential security risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for accesscontrol.
