Cyber ·
Plone: flaw in plone.app.content lets unauthenticated users list users via REST API
Security notice dated 22 October 2026: unauthenticated users can list users and groups of Plone sites with the REST API enabled, including user ID and full name.
The Plone and Zope security team announced an information disclosure vulnerability in the plone.app.content package. According to the summary, an unauthenticated user can list the users and groups of a Plone site. The results include the user ID and full name. The problem affects sites that have the Plone REST API enabled. The original text was published on 22 October 2026 in the oss-sec feed by Maurits van Rees, and the advisory identifier is GHSA-vhwp-qc29-j4xp. The copy received is an automatic translation and is cut off before the full list of conditions, so it does not state affected versions or the fixed version.
To verify, consult the original advisory in the package's official repository and in the oss-sec feed, which contain affected versions, fixes and guidance. If your organization runs Plone with the REST API, confirm whether it is enabled and who can reach the user and group endpoints. Rota Nacional does not fix or assess this vulnerability. It only comes into play if you use AI to study the advisory.
Original source: Correção de segurança do Plone 20261022: divulgação de informações