CVE-2023-41050: Information Disclosure in AccessControl
Summary
CVE-2023-41050: Information disclosure in AccessControl. Affects accesscontrol across 3 version ranges.
< 4.4
>= 5.0, < 5.8
>= 6.0, < 6.2
Fixed in 4.4, 5.8 or 6.2, depending on the release line you run. How to fix ↓
Also tracked for
- zope · PyPI
The same CVE-2023-41050 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AccessControl is a Python package that provides a security framework for controlling access to objects in a Python application. It allows users to define access control policies and restrict access to certain resources. However, a vulnerability has been discovered in AccessControl that allows an attacker to disclose sensitive information through the 'format' functionality of Python. This vulnerability affects all versions of AccessControl prior to 4.4, 5.8, and 6.2.
Vulnerability Detail
The vulnerability in AccessControl arises from the use of Python's 'format' functionality, which can be controlled by an attacker to read objects accessible via attribute access and subscription. This can lead to critical information disclosure. Although AccessControl provides a safe variant for 'str.format', the 'str.format_map' function remains unsafe. This vulnerability can be exploited by untrusted users who are able to create and execute AccessControl controlled Python code. The impact of this vulnerability is moderate, with a CVSS score of 6.8.
How To Fix
Latest published version: 7.5.0 as of 23 Oct 2026
pip install --upgrade "accesscontrol==7.5.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.44.4pip install --upgrade "accesscontrol==4.4" -
>= 5.0, < 5.85.8pip install --upgrade "accesscontrol==5.8" -
>= 6.0, < 6.26.2pip install --upgrade "accesscontrol==6.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is crucial to update to the patched versions of AccessControl to ensure the security of your application.
Conclusion
The vulnerability in AccessControl allows for information disclosure through the 'format' functionality of Python. To mitigate this vulnerability, it is crucial to update to the latest versions of AccessControl: 4.4, 5.8, or 6.2. These versions contain the necessary patches to address the issue. If you require further assistance or support in resolving this vulnerability, please contact DevNack.com.
See every vulnerability recorded for accesscontrol →
FAQ
AccessControl is a Python package that provides a security framework for controlling access to objects in a Python application.
The vulnerability allows an attacker to disclose sensitive information through the 'format' functionality of Python, potentially leading to critical information disclosure.
All users who allow untrusted users to create and execute AccessControl controlled Python code are affected by this vulnerability.
No, there are no known workarounds. It is recommended to update to the patched versions of AccessControl.
The CVSS score of this vulnerability is 6.8, indicating a moderate impact.
References
Related vulnerabilities
Recent vulnerabilities recorded for accesscontrol.
