PyPI/accesscontrol CVE-2026-77401: medium 6.8, EPSS 0.47%

Zope AccessControl vulnerable to information disclosure through Python string `format` and `format_map` functions

Action: Upgrade accesscontrol to 7.4 or later.

pip install accesscontrol==7.4

Affected

Fixed versions

Sources

• osv: PYSEC-2026-4022
• https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-pq59-9fq7-m886
• https://nvd.nist.gov/vuln/detail/CVE-2026-77401
• https://github.com/zopefoundation/AccessControl/commit/f980450eea416718be62847f34dfd51822938e43
• https://github.com/zopefoundation/AccessControl
• https://github.com/zopefoundation/AccessControl/releases/tag/7.4
• https://pypi.org/project/accesscontrol
• https://github.com/advisories/GHSA-pq59-9fq7-m886

CVE-2026-77401 · published 2026-10-01T16:38:32.886701Z · modified 2026-10-01T17:45:03.127620253Z · JSON