Zope AccessControl vulnerable to information disclosure through Python string `format` and `format_map` functions
### Impact Python's string `format` functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown `getattr` and `getitem`, not the policy restricted `AccessControl` variants `_getattr_` and `_getitem_`. This can lead to critical information disclosure. The `AccessControl` package already guards against direct access to the formatting functions on string instances, but these mitigations did not cover subclasses of `str`. Affected are all users who allow untrusted users to create AccessControl controlled Python code and execute it. ### Patches A fix was published with version 7.4. ### Workarounds There is no workaround.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-77401US | — | — | ||
Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-controlled Pytho… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/zopefoundation/AccessControlPACKAGE
- https://github.com/zopefoundation/AccessControl/commit/f980450eea416718be62847f34dfd51822938e43WEB
- https://github.com/zopefoundation/AccessControl/releases/tag/7.4WEB
- https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-pq59-9fq7-m886WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-77401ADVISORY
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan