Plone: Unauthenticated user enumeration via plone.app.content

The Plone security team has disclosed an information disclosure vulnerability in plone.app.content (GHSA-vhwp-qc29-j4xp). The flaw permits unauthenticated users to list all users and groups registered on a Plone site. The leaked information includes specific user IDs and full names. The vulnerability affects Plone installations where the Plone REST API is enabled.

Impact

Successful exploitation allows for the enumeration of organizational user directories, providing an attacker with a list of valid usernames that can be used for subsequent password spraying, phishing, or targeted social engineering campaigns.

Recommendation

• Identify all Plone instances running plone.app.content and verify if the REST API is exposed.
• Review the security advisory at https://github.com/plone/plone.app.content/security/advisories/GHSA-vhwp-qc29-j4xp for specific patching instructions and version updates.
• Apply the vendor-provided patch or upgrade to the non-vulnerable version as specified in the advisory.