Threat Advisory

Zope AccessControl Vulnerable to Information Disclosure via Python String Format Functions

Threat: Vulnerability
Targeted Region: Global
Targeted Sector: Technology & IT
Criticality: High
[subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

A medium severity vulnerability, CVE-2026-77401 with a CVSS score of 6.8, affects users who allow untrusted individuals to create AccessControl controlled Python code and execute it, potentially leading to critical information disclosure through Python string format and format_map functions. This flaw type exploits the attribute access and subscription mechanism in Python's full blown getattr and getitem functionality, which can be leveraged by an attacker to read objects accessible via recursive attribute access and subscription from accessible objects. The AccessControl package guards against direct access to formatting functions on string instances but does not cover subclasses of str, making all users vulnerable who allow untrusted users to create such code and execute it. Affected versions are AccessControl: < 7.4, which is now patched with version 7.4.

RECOMMENDATION:

We recommend you to update AccessControl to version 7.4.[/subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

A medium severity vulnerability, CVE-2026-77401 with a CVSS score of 6.8, affects users who allow untrusted individuals to create AccessControl controlled Python code and execute it, potentially leading to critical information disclosure through Python string format and format_map functions. This flaw type exploits the attribute access and subscription mechanism in Python's full blown getattr and getitem functionality, which can be leveraged by an attacker to read objects accessible via recursive attribute access and subscription from accessible objects. The AccessControl package guards against direct access to formatting functions on string instances but does not cover subclasses of str, making all users vulnerable who allow untrusted users to create such code and execute it. Affected versions are AccessControl: < 7.4, which is now patched with version 7.4.

RECOMMENDATION:

We recommend you to update AccessControl to version 7.4.[emaillocker id="1283"]

REFERENCES:

The following reports contain further technical details:

[/emaillocker]
crossmenu