CVE-2026-77401: AccessControl Package Vulnerable to Information Disclosure via String Formatting
Summary
CVE-2026-77401: Impact Python's string format functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Affects accesscontrol versions < 7.4. Fixed in 7.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The AccessControl package is a crucial component in Python that provides security mechanisms for controlling access to objects. It is widely used in web applications, particularly those built on the Zope framework. The package implements policies that restrict access to sensitive data and functionalities, ensuring that only authorized users can interact with certain objects. However, a vulnerability has been identified that allows untrusted users to exploit string formatting functions, leading to potential information disclosure.
Vulnerability Detail
The vulnerability arises from Python's string format and format_map functions, which can be manipulated by an attacker to access objects through attribute access and subscription. Unlike the restricted access methods provided by AccessControl, these functions utilize Python's built-in getattr and getitem, bypassing the security measures in place. This flaw can lead to critical information disclosure, especially for applications that allow untrusted users to execute Python code with AccessControl.
How To Fix
Latest published version: 7.5.0 as of 23 Oct 2026
pip install --upgrade "accesscontrol==7.5.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.4
This is the first release that contains the fix.
pip install --upgrade "accesscontrol==7.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. The best course of action is to update to the patched version of the AccessControl package.
Conclusion
The AccessControl package has a significant vulnerability (CVE-2026-77401) that can lead to information disclosure through improper use of string formatting functions. Users are strongly advised to update to version 7.4 or later to protect their applications from potential exploitation.
See every vulnerability recorded for accesscontrol →
FAQ
CVE-2026-77401 is a vulnerability in the AccessControl package that allows information disclosure through Python's string formatting functions.
All users of the AccessControl package who allow untrusted users to create and execute Python code are affected.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 6.8, indicating a moderate level of severity.
While there is no workaround, it is crucial to prioritize updating the package to mitigate the risk of information disclosure.
References
Related vulnerabilities
Recent vulnerabilities recorded for accesscontrol.
