CVE-2021-33926: Plone CMS Sensitive Information Exposure via RSS Feed
Summary
CVE-2021-33926: An issue in Plone CMS v. Affects plone versions >= 4.3, < 5.2.5. Fixed in 5.2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system (CMS) built on the Zope application server. It is designed for managing web content and offers features such as workflow management, versioning, and user management. Plone is widely used for building websites, intranets, and extranets. However, certain versions of Plone CMS are vulnerable to an issue that allows attackers to access sensitive information through the RSS feed portlet.
Vulnerability Detail
The vulnerability identified as CVE-2021-33926 affects multiple versions of Plone CMS, including 5.2.4, 5.2.3, 5.2.2, and earlier versions down to 4.3.3. This issue arises from improper handling of sensitive information in the RSS feed portlet, which can be exploited by an attacker to gain unauthorized access to confidential data. The potential ramifications include data leakage and exposure of sensitive user information, which could lead to further attacks or privacy violations.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.2.5
This is the first release that contains the fix.
pip install --upgrade "plone==5.2.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can disable the RSS feed portlet or restrict access to it until the system can be updated. This can be done by modifying the configuration settings in the Plone control panel to limit visibility or access to the RSS feed.
Conclusion
CVE-2021-33926 is a significant vulnerability in Plone CMS that exposes sensitive information through the RSS feed portlet. Users are strongly advised to upgrade to the latest patched version to mitigate the risk. Additionally, temporary workarounds can be implemented to limit exposure until an update can be performed.
See every vulnerability recorded for plone →
FAQ
CVE-2021-33926 is a vulnerability in Plone CMS that allows attackers to access sensitive information via the RSS feed portlet.
Affected versions include Plone CMS 5.2.4, 5.2.3, 5.2.2, and earlier versions down to 4.3.3.
The vulnerability can lead to unauthorized access to sensitive information, potentially resulting in data leakage and privacy violations.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2021-33926 is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for plone.
