Plone security fixes 20261022

Announcements Security
1

On behalf of the Plone/Zope Security Team I announce an information disclosure vulnerability in plone.app.content. See the vulnerability advisory. Summary: the users and groups of a Plone site can be listed by an unauthenticated user. The results include the user id and full name of the users.

This impacts Plone sites that have the Plone REST API enabled but do not have the "many users?" and "many groups?" settings enabled. So a workaround is to enable those settings.

Fixes are available for the supported Plone versions:

  • for Plone 6.0 and 6.1: use plone.app.content 4.2.1
  • for Plone 6.2: use plone.app.content 5.0.1

Additionally, you should upgrade pip, and certifi to versions that fix a certificate security incident.

Also, if you are on Python 3.11 or higher, and you use Plone 6.2, you should upgrade to Pillow 13.0.0 for lots of security fixes. On earlier Plone versions this may work as well, but there we currently use Pillow 11, so that would be a big version jump, so you may want to test this some more.

You should update your Plone sites to the following versions (formatted as pip constraints here):

For Plone 6.2:

plone.app.content==5.0.1
pip==26.2.2
certifi==2026.10.19
Pillow==13.0.0; python_version > "3.10"
Pillow==12.3.0; python_version == "3.10"

For Plone 6.0 and 6.1:

plone.app.content==4.2.1
pip==26.2.2
certifi==2026.10.19

Meanwhile Plone 6.2.2.1 has been released with all the above fixes. The Plone 6.2.2.1 Docker images have newer base OS images that have related fixes, for example a newer ca-certificates package.

3 Likes
3

Due to a global security incident yesterday with certificates, you should also update pip and certifi. And possibly Pillow.

In this special case, I have released Plone 6.2.2.1 with all those fixes. I will announce that separately, but you can view the release notes already, and use the versions/constraints. Docker images are being built, which is important as the base OS images need some updates to be really safe.

Once the dust has settled, I will update the original report. [Update: done.]