CVE-2026-77401: Zope AccessControl information disclosure via string format functions

CVE-2026-77401 · Severity: medium · CVSS 6.8 · Published 2026-09-16

Zope AccessControl is a security layer that controls how Python code can access objects in applications built on Zope. An attacker who can create and execute Python code can exploit Python's string formatting functions (format and format_map) to bypass access restrictions and read sensitive data from protected objects. This affects organizations using Zope with untrusted code execution features.

Technologies: AccessControl (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-77401 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-77401 being exploited in the wild.
How severe is CVE-2026-77401?
Medium severity, with a CVSS score of 6.8, published 16 September 2026.
Which products and versions are affected?
AccessControl (PyPI) < 7.4, ECOSYSTEM:introduced=0,fixed=7.4.
Is there a fix for CVE-2026-77401?
Yes. AccessControl (PyPI): upgrade to 7.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77401 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-77401?
Check whether you run AccessControl (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • AccessControl (PyPI): upgrade to 7.4 or later
    pip install "AccessControl>=7.4"

Technical details

The vulnerability is a protection mechanism bypass (CWE-693) in the Zope AccessControl package. Python's string format and format_map functions allow attribute access and item subscription through format specifiers, but these accesses use Python's built-in getattr and getitem rather than AccessControl's restricted _getattr_ and _getitem_ variants. While AccessControl guards against direct calls to format/format_map on string instances, the protection did not cover subclasses of str. An attacker with the ability to execute Python code controlled by AccessControl can craft a format string using a str subclass to recursively access and read protected object attributes. The vulnerability requires high privileges (ability to write untrusted code) but has network-accessible vectors and changes security scope (C:H). A patch is available in version 7.4.

Affected products

  • Zope Foundation AccessControl < 7.4

Identifiers

  • CVE-2026-77401
  • GHSA-pq59-9fq7-m886
  • PYSEC-2026-4022

Timeline

  • 2026-07-20: disclosed: Published by GitHub Advisory Database
  • 2026-07-20: patched: Fix released in version 7.4
  • 2026-09-17: advisory: GHSA-pq59-9fq7-m886 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.