CVE-2021-32807: Remote Code Execution in AccessControl
Summary
CVE-2021-32807: Remote Code Execution via unsafe classes in otherwise permitted modules. Affects accesscontrol across 2 version ranges.
>= 4.0, < 4.3
>= 5.0, < 5.2
Fixed in 4.3 or 5.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2021-32807 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AccessControl is a Python module used in Zope applications to define security policies for restricted code. It restricts access to Python modules, allowing only a few safe ones. However, a vulnerability in AccessControl allows the class Formatter in the string module to be overridden and extended, providing access to unsafe Python libraries. This can lead to remote code execution.
Vulnerability Detail
The vulnerability in AccessControl arises from the unrestricted access to the Formatter class in the string module. By overriding and extending this class, an attacker can gain access to unsafe Python libraries and execute arbitrary code. This can have severe consequences, especially in cases where untrusted users are allowed to add or edit Script (Python) objects through the web.
How To Fix
Latest published version: 7.5.0 as of 23 Oct 2026
pip install --upgrade "accesscontrol==7.5.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.0, < 4.34.3pip install --upgrade "accesscontrol==4.3" -
>= 5.0, < 5.25.2pip install --upgrade "accesscontrol==5.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
To mitigate the risk, site administrators can restrict the ability to add or edit Script (Python) objects through the web to trusted users only. This can be achieved by using the standard Zope user/role permission mechanisms and ensuring that untrusted users are not assigned the Zope Manager role.
Conclusion
The vulnerability in AccessControl allows for remote code execution, posing a significant risk to systems that allow untrusted users to add or edit Script (Python) objects through the web. It is crucial to update to the patched versions of AccessControl and implement proper access restrictions to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for accesscontrol →
FAQ
AccessControl is a Python module used in Zope applications to define security policies for restricted code.
The vulnerability allows for remote code execution, potentially leading to unauthorized access or malicious activities.
AccessControl versions 4 and 5 on Python 3 are vulnerable. Python 2.7 is not affected.
Update to the latest patched version of AccessControl (4.3 or 5.2) to fix the vulnerability.
Yes, site administrators can restrict the ability to add or edit Script (Python) objects through the web to trusted users only.
References
Related vulnerabilities
Recent vulnerabilities recorded for accesscontrol.
