{"id":"CVE-2026-77401","aliases":["EUVD-2026-80790","GHSA-pq59-9fq7-m886","PYSEC-2026-4022"],"status":"published","title":"Zope AccessControl: Information disclosure through Python string `format` and `format_map` functions","description":"Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-controlled Python code do not safely guard str.format and str.format_map when those methods are reached through a str subclass. In both ImplPython.py and cAccessControl.c, Python formatting can recursively access attributes and subscriptions using unrestricted getattr and getitem behavior instead of the policy-restricted getattr and getitem operations. A controlled format string can therefore disclose objects reachable from values available to the formatting operation. This issue is fixed in version 7.4.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00469,"percentile":0.40894,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-693"],"published":"2026-09-16T14:28:01Z","modified":"2026-10-28T11:00:37Z","fixes":[{"ecosystem":"PyPI","package":"accesscontrol","fixed_in":["7.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"accesscontrol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"accesscontrol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4"}]}],"versions":["2.13.0","2.13.1","2.13.10","2.13.11","2.13.12","2.13.13","2.13.14","2.13.15","2.13.16","2.13.2","2.13.3","2.13.4","2.13.5","2.13.6","2.13.7","2.13.8","2.13.9","3.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","4.0","4.0a1","4.0a2","4.0a3","4.0a4","4.0a5","4.0a6","4.0a7","4.0b1","4.0b2","4.0b3","4.0b4","4.0b5","4.0b6","4.0b7","4.1","4.2","4.3","4.4","5.0","5.1","5.2","5.3","5.3.1","5.4","5.5","5.6","5.7","6.0","6.1","6.2","6.3","7.0","7.1","7.2","7.3"]},{"source":"osv","ecosystem":"PyPI","package":"accesscontrol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4"}]}],"versions":["2.13.0","2.13.1","2.13.10","2.13.11","2.13.12","2.13.13","2.13.14","2.13.15","2.13.16","2.13.2","2.13.3","2.13.4","2.13.5","2.13.6","2.13.7","2.13.8","2.13.9","3.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","4.0","4.0a1","4.0a2","4.0a3","4.0a4","4.0a5","4.0a6","4.0a7","4.0b1","4.0b2","4.0b3","4.0b4","4.0b5","4.0b6","4.0b7","4.1","4.2","4.3","4.4","5.0","5.1","5.2","5.3","5.3.1","5.4","5.5","5.6","5.7","6.0","6.1","6.2","6.3","7.0","7.1","7.2","7.3"]}],"products":[{"vendor":"zopefoundation","product":"accesscontrol"}],"references":[{"url":"https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-pq59-9fq7-m886","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/zopefoundation/AccessControl/commit/f980450eea416718be62847f34dfd51822938e43","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/zopefoundation/AccessControl/releases/tag/7.4","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77401","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pq59-9fq7-m886","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77401.json","tags":["advisory"]},{"url":"https://github.com/zopefoundation/AccessControl","tags":["package"]},{"url":"https://pypi.org/project/accesscontrol","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-77401","title":"Zope AccessControl: Information disclosure through Python string `format` and `format_map` functions","description":"Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-controlled Python code do not safely guard str.format and str.format_map when those methods are reached through a str subclass. In both ImplPython.py and cAccessControl.c, Python formatting can recursively access attributes and subscriptions using unrestricted getattr and getitem behavior instead of the policy-restricted getattr and getitem operations. A controlled format string can therefore disclose objects reachable from values available to the formatting operation. This issue is fixed in version 7.4.","status":"published","published":"2026-09-16T14:28:01.186Z","modified":"2026-09-16T18:35:46.823Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:20:15.712761Z"}],"euvd":[{"id":"EUVD-2026-80790","description":"Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-controlled Python code do not safely guard str.format and str.format_map when those methods are reached through a str subclass. In both ImplPython.py and cAccessControl.c, Python formatting can recursively access attributes and subscriptions using unrestricted getattr and getitem behavior instead of the policy-restricted getattr and getitem operations. A controlled format string can therefore disclose objects reachable from values available to the formatting operation. This issue is fixed in version 7.4.","status":"published","published":"2026-09-16T14:28:01Z","modified":"2026-09-16T18:35:46Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:14.33177Z"}],"ghsa":[{"id":"GHSA-pq59-9fq7-m886","title":"Zope AccessControl vulnerable to information disclosure through Python string `format` and `format_map` functions","description":"### Impact\nPython's string `format` functionality allows someone controlling the format string to \"read\" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown `getattr` and `getitem`, not the policy restricted `AccessControl` variants `_getattr_` and `_getitem_`. This can lead to critical information disclosure.\n\nThe `AccessControl` package already guards against direct access to the formatting functions on string instances, but these mitigations did not cover subclasses of `str`.\n\nAffected are all users who allow untrusted users to create AccessControl controlled Python code and execute it.\n\n### Patches\nA fix was published with version 7.4.\n\n### Workarounds\nThere is no workaround.","status":"published","published":"2026-09-17T16:30:37Z","modified":"2026-09-17T16:30:38Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:41:18.357514Z"}],"nvd":[{"id":"CVE-2026-77401","description":"Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-controlled Python code do not safely guard str.format and str.format_map when those methods are reached through a str subclass. In both ImplPython.py and cAccessControl.c, Python formatting can recursively access attributes and subscriptions using unrestricted getattr and getitem behavior instead of the policy-restricted getattr and getitem operations. A controlled format string can therefore disclose objects reachable from values available to the formatting operation. This issue is fixed in version 7.4.","status":"published","published":"2026-09-16T15:17:46.617Z","modified":"2026-09-30T17:43:24.057Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:12:48.630594Z"}],"osv":[{"id":"CVE-2026-77401","title":"Zope AccessControl: Information disclosure through Python string `format` and `format_map` functions","description":"Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-controlled Python code do not safely guard str.format and str.format_map when those methods are reached through a str subclass. In both ImplPython.py and cAccessControl.c, Python formatting can recursively access attributes and subscriptions using unrestricted getattr and getitem behavior instead of the policy-restricted getattr and getitem operations. A controlled format string can therefore disclose objects reachable from values available to the formatting operation. This issue is fixed in version 7.4.","status":"published","published":"2026-09-16T14:28:01.186Z","modified":"2026-10-28T11:00:37.589386285Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T15:45:17.102988Z"},{"id":"GHSA-pq59-9fq7-m886","title":"Zope AccessControl vulnerable to information disclosure through Python string `format` and `format_map` functions","description":"### Impact\nPython's string `format` functionality allows someone controlling the format string to \"read\" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown `getattr` and `getitem`, not the policy restricted `AccessControl` variants `_getattr_` and `_getitem_`. This can lead to critical information disclosure.\n\nThe `AccessControl` package already guards against direct access to the formatting functions on string instances, but these mitigations did not cover subclasses of `str`.\n\nAffected are all users who allow untrusted users to create AccessControl controlled Python code and execute it.\n\n### Patches\nA fix was published with version 7.4.\n\n### Workarounds\nThere is no workaround.","status":"published","published":"2026-09-17T16:30:37Z","modified":"2026-10-01T17:56:05.701166603Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"PYSEC-2026-4022","title":"Zope AccessControl vulnerable to information disclosure through Python string `format` and `format_map` functions","description":"### Impact\nPython's string `format` functionality allows someone controlling the format string to \"read\" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown `getattr` and `getitem`, not the policy restricted `AccessControl` variants `_getattr_` and `_getitem_`. This can lead to critical information disclosure.\n\nThe `AccessControl` package already guards against direct access to the formatting functions on string instances, but these mitigations did not cover subclasses of `str`.\n\nAffected are all users who allow untrusted users to create AccessControl controlled Python code and execute it.\n\n### Patches\nA fix was published with version 7.4.\n\n### Workarounds\nThere is no workaround.","status":"published","published":"2026-10-01T16:38:32.886701Z","modified":"2026-10-01T17:45:03.127620253Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:57.255153Z"}]}}