Is CVE-2011-1950 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2011-1950 being exploited in the wild.

How severe is CVE-2011-1950?

Low severity, with a CVSS score of 3.1, published 9 July 2026.

Which products and versions are affected?

Plone 4.0.1–4.0.5, 4.1.0; plone (PyPI) ECOSYSTEM:introduced=0,fixed=4.1.1; plone-app-users (PyPI) ECOSYSTEM:introduced=1.0a1,fixed=1.0.5,introduced=1.1b1,fixed=1.1.1.

Is there a fix for CVE-2011-1950?

Yes. plone (PyPI): upgrade to 4.1.1 or later; plone-app-users (PyPI): upgrade to 1.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2011-1950 attacked?

It is attacked over the network.

Am I affected by CVE-2011-1950?

Check whether you run Plone, plone (PyPI) or plone-app-users (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2011-1950: PYSEC-2026-2888 - Plone and plone.app.users allow remote authenticated users to modify the properties of arbitrary accounts

CVE-2011-1950 · Severity: low · CVSS 3.1 · Published 2026-07-09

Plone is an open-source content management system used to build websites and intranets. An authenticated user can modify the properties of arbitrary accounts, potentially escalating privileges or compromising other user accounts. This allows someone with a regular user login to tamper with administrator or other privileged accounts without authorization.

Technologies: Plone, plone (PyPI). Vendors: Plone, PyPI.

Quick answers

Is CVE-2011-1950 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2011-1950 being exploited in the wild.
How severe is CVE-2011-1950?: Low severity, with a CVSS score of 3.1, published 9 July 2026.
Which products and versions are affected?: Plone 4.0.1–4.0.5, 4.1.0; plone (PyPI) ECOSYSTEM:introduced=0,fixed=4.1.1; plone-app-users (PyPI) ECOSYSTEM:introduced=1.0a1,fixed=1.0.5,introduced=1.1b1,fixed=1.1.1.
Is there a fix for CVE-2011-1950?: Yes. plone (PyPI): upgrade to 4.1.1 or later; plone-app-users (PyPI): upgrade to 1.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2011-1950 attacked?: It is attacked over the network.
Am I affected by CVE-2011-1950?: Check whether you run Plone, plone (PyPI) or plone-app-users (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

plone (PyPI): upgrade to 4.1.1 or later
```
pip install "plone>=4.1.1"
```
plone-app-users (PyPI): upgrade to 1.1.1 or later
```
pip install "plone-app-users>=1.1.1"
```

Technical details

The vulnerability exists in plone.app.users, a Plone package that handles user management. An authenticated attacker can modify properties of arbitrary user accounts through unspecified vectors, likely due to insufficient authorization checks. The attack requires valid login credentials but does not require administrative access. An attacker can exploit this to escalate privileges, lock out other users, or hijack high-privilege accounts. Patches are available in plone-app-users 1.0.5+, 1.1.1+, and Plone 4.0.6+ and 4.1.1+.

Affected products

Plone plone 4.0.1–4.0.5, 4.1.0
Plone plone.app.users 1.0a1–1.0.4, 1.1b1–1.1

Identifiers

CVE-2011-1950
GHSA-2qx8-589j-gcpx
PYSEC-2011-16
PYSEC-2026-2888

Timeline

2011-06: disclosed: Vulnerability exploited in the wild
2018-07-23: advisory: GHSA-2qx8-589j-gcpx published
2011: patched: Patches released for affected versions

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/67695

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.