{"id":"PYSEC-2026-2075","summary":"Information disclosure in AccessControl","details":"### Impact\nPython's \"format\" functionality allows someone controlling the format string to \"read\" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown `getattr` and `getitem`, not the policy restricted `AccessControl` variants `_getattr_` and `_getitem_`. This can lead to critical information disclosure.\n\n`AccessControl` already provides a safe variant for `str.format` and denies access to `string.Formatter`. However, `str.format_map` is still unsafe.\n\nAffected are all users who allow untrusted users to create `AccessControl` controlled Python code and execute it.\n\n### Patches\nA fix will be introduced in the versions 4.4, 5.8 and 6.2.\n\n### Workarounds\nThere are no workarounds.\n\n### References\nhttps://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-xjw2-6jm9-rf67 describes the corresponding problem for `RestrictedPython`.\n","aliases":["CVE-2023-41050","GHSA-8xv7-89vj-q48c","PYSEC-2026-2325"],"modified":"2026-07-13T16:56:17.319490717Z","published":"2026-07-07T11:45:23.791023Z","references":[{"type":"WEB","url":"https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-8xv7-89vj-q48c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41050"},{"type":"WEB","url":"https://github.com/zopefoundation/AccessControl/commit/6bc32692e0d4b8d5cf64eae3d19de987c7375bc9"},{"type":"PACKAGE","url":"https://github.com/zopefoundation/AccessControl"},{"type":"PACKAGE","url":"https://pypi.org/project/zope"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-8xv7-89vj-q48c"}],"affected":[{"package":{"name":"zope","ecosystem":"PyPI","purl":"pkg:pypi/zope"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.9"},{"introduced":"5.0.0"},{"fixed":"5.8.4"}]}],"versions":["4.0","4.0b1","4.0b10","4.0b2","4.0b3","4.0b4","4.0b5","4.0b6","4.0b7","4.0b8","4.0b9","4.1","4.1.1","4.1.2","4.1.3","4.2","4.2.1","4.3","4.4","4.4.1","4.4.2","4.4.3","4.4.4","4.5","4.5.1","4.5.2","4.5.3","4.5.4","4.5.5","4.6","4.6.1","4.6.2","4.6.3","4.7","4.8","4.8.1","4.8.2","4.8.3","4.8.4","4.8.5","4.8.6","4.8.7","4.8.8","5.0","5.1","5.1.1","5.1.2","5.2","5.2.1","5.3","5.4","5.5","5.5.1","5.5.2","5.6","5.7","5.7.1","5.7.2","5.7.3","5.8","5.8.1","5.8.2","5.8.3"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/zope/PYSEC-2026-2075.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N"}]}