Zope AccessControl vulnerable to information disclosure through Python string `format` and `format_map` functions

ImpactPython's string format functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy...

dcicsnovault (>=2.0.0b4, <=2.0.0b7), moksh-orchestrator (0.2.1) +1 more potentially affected by CVE-2026-76825 via restrictedpython (6.0.0a1.dev0)

restrictedpython PYPI version 6.0.0a1.dev0 is affected by a known vulnerability. The following packages have a transitive dependency on restrictedpython and may be impacted: - dcicsnovault =2.0.0b4, =4.8.4, =4.8.11 Source cves: CVE-2026-76825 Source advisory: OSV:PYSEC-2026-4161...

PYSEC-2026-4022 Zope AccessControl vulnerable to information disclosure through Python string `format` and `format_map` functions

Impact Python's string format functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy...

dcicsnovault (>=2.0.0b4, <=2.0.0b7), moksh-orchestrator (0.2.1) +1 more potentially affected by CVE-2026-77401 via accesscontrol (4.4.0)

accesscontrol PYPI version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on accesscontrol and may be impacted: - dcicsnovault =2.0.0b4, =4.6.3, =4.8.11 Source cves: CVE-2026-77401 Source advisory: OSV:PYSEC-2026-4022...

VulnCheck KEV: CVE-2026-54569

SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing authorization and unsafe evaluation. The state-changing routes in...

dcicsnovault (>=2.0.0b4, <=2.0.0b7), moksh-orchestrator (0.2.1) +1 more potentially affected by CVE-2026-77401 via accesscontrol (4.4.0)

accesscontrol PYPI version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on accesscontrol and may be impacted: - dcicsnovault =2.0.0b4, =4.6.3, =4.8.11 Source cves: CVE-2026-77401 Source advisory: OSV:GHSA-PQ59-9FQ7-M886...

GHSA-PQ59-9FQ7-M886 Zope AccessControl vulnerable to information disclosure through Python string `format` and `format_map` functions

Impact Python's string format functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy...

Zope AccessControl vulnerable to information disclosure through Python string `format` and `format_map` functions

Impact Python's string format functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy...

EUVD-2026-80790

Zope AccessControl vulnerable to information disclosure through Python string format and formatmap functions...

dcicsnovault (>=2.0.0b4, <=2.0.0b7), moksh-orchestrator (0.2.1) +1 more potentially affected by CVE-2026-76825 via restrictedpython (6.0.0a1.dev0)

restrictedpython PYPI version 6.0.0a1.dev0 is affected by a known vulnerability. The following packages have a transitive dependency on restrictedpython and may be impacted: - dcicsnovault =2.0.0b4, =4.8.4, =4.8.11 Source cves: CVE-2026-76825 Source advisory: OSV:GHSA-HP3V-5VW7-FX9W...

Zope AccessControl vulnerable to information disclosure through Python string `format` and `format_map` functions

Python's string format functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy restrict...

CVE-2026-77401

Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-controlled Python code do not safely guard str.format and str.formatmap when those methods are reached through a str subclass. In bot...

CVE-2026-77401

Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-controlled Python code do not safely guard str.format and str.formatmap when those methods are reached through a str subclass. In bot...

CVE-2026-77401 Zope AccessControl: Information disclosure through Python string `format` and `format_map` functions

Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-controlled Python code do not safely guard str.format and str.formatmap when those methods are reached through a str subclass. In bot...

CVE-2026-77401 Zope AccessControl: Information disclosure through Python string `format` and `format_map` functions

Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-controlled Python code do not safely guard str.format and str.formatmap when those methods are reached through a str subclass. In bot...

CVE-2026-77401

Zope AccessControl prior to version 7.4 is vulnerable to information disclosure through Python string str.format and str.format_map functions. When these methods are reached via a str subclass in applications allowing untrusted users to execute AccessControl-controlled Python code, formatting in ...

CVE-2026-77401 Zope AccessControl: Information disclosure through Python string `format` and `format_map` functions

Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-controlled Python code do not safely guard str.format and str.formatmap when those methods are reached through a str subclass. In bot...

dcicsnovault (>=2.0.0b4, <=2.0.0b7), ethyca-fides (>=2.10.0, <=2.13.0) +2 more potentially affected by CVE-2026-77401 via accesscontrol (>=4.4.0, <=6.0.0)

accesscontrol PYPI version =4.4.0, =2.0.0b4, =2.10.0, =4.6.3, =4.8.11 Source cves: CVE-2026-77401 Source advisory: MEND:CVE-2026-77401...

CVE-2026-77401: Protection Mechanism Failure

Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-controlled Python code do not safely guard str.format and str.formatmap when those methods are reached through a str subclass. In bot...

PT-2026-93792

Name of the Vulnerable Software and Affected Versions Zope AccessControl versions prior to 7.4 Description Applications that allow untrusted users to create and execute AccessControl-controlled Python code fail to safely guard str.format and str.format map when accessed through a str subclass. In...