# CVE-2011-1950: PYSEC-2026-2888 - Plone and plone.app.users allow remote authenticated users to modify the properties of arbitrary accounts

Source: https://junglewise.ai/threats/cve-2011-1950-plone-privilege-escalation-in-account-property-modification  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2011-1950 · Severity: low · CVSS 3.1 · Published 2026-07-09

Plone is an open-source content management system used to build websites and intranets. An authenticated user can modify the properties of arbitrary accounts, potentially escalating privileges or compromising other user accounts. This allows someone with a regular user login to tamper with administrator or other privileged accounts without authorization.

Technologies: [Plone](https://junglewise.ai/threats/technologies/plone), [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone). Vendors: [Plone](https://junglewise.ai/threats/vendors/plone), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2011-1950 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2011-1950 being exploited in the wild.

**How severe is CVE-2011-1950?** Low severity, with a CVSS score of 3.1, published 9 July 2026.

**Which products and versions are affected?** Plone 4.0.1–4.0.5, 4.1.0; plone (PyPI) ECOSYSTEM:introduced=0,fixed=4.1.1; plone-app-users (PyPI) ECOSYSTEM:introduced=1.0a1,fixed=1.0.5,introduced=1.1b1,fixed=1.1.1.

**Is there a fix for CVE-2011-1950?** Yes. plone (PyPI): upgrade to 4.1.1 or later; plone-app-users (PyPI): upgrade to 1.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2011-1950 attacked?** It is attacked over the network.

**Am I affected by CVE-2011-1950?** Check whether you run Plone, plone (PyPI) or plone-app-users (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- plone (PyPI): upgrade to 4.1.1 or later

  ```sh
  pip install "plone>=4.1.1"
  ```

- plone-app-users (PyPI): upgrade to 1.1.1 or later

  ```sh
  pip install "plone-app-users>=1.1.1"
  ```


## Technical details

The vulnerability exists in plone.app.users, a Plone package that handles user management. An authenticated attacker can modify properties of arbitrary user accounts through unspecified vectors, likely due to insufficient authorization checks. The attack requires valid login credentials but does not require administrative access. An attacker can exploit this to escalate privileges, lock out other users, or hijack high-privilege accounts. Patches are available in plone-app-users 1.0.5+, 1.1.1+, and Plone 4.0.6+ and 4.1.1+.

## Affected products

- Plone plone 4.0.1–4.0.5, 4.1.0
- Plone plone.app.users 1.0a1–1.0.4, 1.1b1–1.1

## Identifiers

- CVE-2011-1950
- GHSA-2qx8-589j-gcpx
- PYSEC-2011-16
- PYSEC-2026-2888

## Timeline

- 2011-06: disclosed: Vulnerability exploited in the wild
- 2018-07-23: advisory: GHSA-2qx8-589j-gcpx published
- 2011: patched: Patches released for affected versions

## References

- [https://exchange.xforce.ibmcloud.com/vulnerabilities/67695](https://exchange.xforce.ibmcloud.com/vulnerabilities/67695)

## Related threats

- [PYSEC-2026-2889 - Plone Privilege Escallation](https://junglewise.ai/threats/cve-2020-7938-plone-privilege-escallation)
- [PYSEC-2026-2964 - Plone unauthorized member addition vulnerability](https://junglewise.ai/threats/cve-2015-7315-plone-unauthorized-member-addition-vulnerability)
- [PYSEC-2026-2962 - Products.CMFPlone XSS in profile home_page property](https://junglewise.ai/threats/cve-2017-1000482-products-cmfplone-xss-in-profile-home-page-property)
- [PYSEC-2026-2963 - Products.CMFPlone Open Redirect Vulnerability](https://junglewise.ai/threats/cve-2017-1000481-products-cmfplone-open-redirect-vulnerability)
- [PYSEC-2026-2967 - Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone](https://junglewise.ai/threats/cve-2021-33507-plone-reflected-cross-site-scripting-vulnerability)