PT-2026-53538 · Pypi · Plone.App.Contenttypes

Published 2026-06-29 · Updated 2026-06-29

OSV

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.

Fix

Related Identifiers

PYSEC-2026-459

Affected Products

Plone.App.Contenttypes

References · 11

• https://osv.dev/vulnerability/PYSEC-2026-459 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7941 · Security Note
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-90.yaml · Note
• https://github.com/plone/plone.app.contenttypes · Note
• https://github.com/plone/plone.app.contenttypes/blob/master/CHANGES.rst?plain=1#L372-L374 · Note
• https://plone.org/security/hotfix/20200121/privilege-escalation-for-overwriting-content · Note
• https://pypi.org/project/plone-app-contenttypes · Note
• https://openwall.com/lists/oss-security/2020/01/22/1 · Note
• https://github.com/advisories/GHSA-w6g9-xccc-347h · Note
• http://openwall.com/lists/oss-security/2020/01/24/1 · Note
• https://plone.org/security/hotfix/20200121 · Note