{"action":"Upgrade plone-app-users to 1.0.5 or later.","affected":[{"fixed":"1.0.5","introduced":"1.0a1"},{"fixed":"1.1.1","introduced":"1.1b1"}],"component":"plone-app-users","cve_ids":["CVE-2011-1950"],"ecosystem":"PyPI","epss":0.02349,"exploited":false,"fixed_versions":["1.0.5","1.1.1"],"ghsa_id":"GHSA-2qx8-589j-gcpx","id":"tcs_01M5KH25RN77MMN8CP9YXSR76C","modified_at":"2026-07-13T16:43:10.969610093Z","published_at":"2026-07-09T16:49:32.377883Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2888","https://nvd.nist.gov/vuln/detail/CVE-2011-1950","https://exchange.xforce.ibmcloud.com/vulnerabilities/67695","https://github.com/advisories/GHSA-2qx8-589j-gcpx","https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2011-16.yaml","http://plone.org/products/plone/security/advisories/CVE-2011-1950","https://pypi.org/project/plone-app-users"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-2888","url":"https://osv.dev/vulnerability/PYSEC-2026-2888"}],"summary":"Plone and plone.app.users allow remote authenticated users to modify the properties of arbitrary accounts"}