id: PYSEC-2026-2325
published: "2026-07-13T14:20:02.135840Z"
modified: "2026-07-13T16:03:10.898262Z"
aliases:
- CVE-2023-41050
- GHSA-8xv7-89vj-q48c
summary: Information disclosure in AccessControl
details: "### Impact\nPython's \"format\" functionality allows someone controlling the format string to \"read\" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown `getattr` and `getitem`, not the policy restricted `AccessControl` variants `_getattr_` and `_getitem_`. This can lead to critical information disclosure.\n\n`AccessControl` already provides a safe variant for `str.format` and denies access to `string.Formatter`. However, `str.format_map` is still unsafe.\n\nAffected are all users who allow untrusted users to create `AccessControl` controlled Python code and execute it.\n\n### Patches\nA fix will be introduced in the versions 4.4, 5.8 and 6.2.\n\n### Workarounds\nThere are no workarounds.\n\n### References\nhttps://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-xjw2-6jm9-rf67 describes the corresponding problem for `RestrictedPython`.\n"
affected:
- package:
    name: accesscontrol
    ecosystem: PyPI
    purl: pkg:pypi/accesscontrol
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: "4.4"
    - introduced: "5.0"
    - fixed: "5.8"
    - introduced: "6.0"
    - fixed: "6.2"
  versions:
  - 2.13.0
  - 2.13.1
  - 2.13.10
  - 2.13.11
  - 2.13.12
  - 2.13.13
  - 2.13.14
  - 2.13.15
  - 2.13.16
  - 2.13.2
  - 2.13.3
  - 2.13.4
  - 2.13.5
  - 2.13.6
  - 2.13.7
  - 2.13.8
  - 2.13.9
  - "3.0"
  - 3.0.1
  - 3.0.10
  - 3.0.11
  - 3.0.12
  - 3.0.13
  - 3.0.14
  - 3.0.2
  - 3.0.3
  - 3.0.4
  - 3.0.5
  - 3.0.6
  - 3.0.7
  - 3.0.8
  - 3.0.9
  - "4.0"
  - 4.0a1
  - 4.0a2
  - 4.0a3
  - 4.0a4
  - 4.0a5
  - 4.0a6
  - 4.0a7
  - 4.0b1
  - 4.0b2
  - 4.0b3
  - 4.0b4
  - 4.0b5
  - 4.0b6
  - 4.0b7
  - "4.1"
  - "4.2"
  - "4.3"
  - "5.0"
  - "5.1"
  - "5.2"
  - "5.3"
  - 5.3.1
  - "5.4"
  - "5.5"
  - "5.6"
  - "5.7"
  - "6.0"
  - "6.1"
references:
- type: WEB
  url: https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-8xv7-89vj-q48c
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2023-41050
- type: WEB
  url: https://github.com/zopefoundation/AccessControl/commit/6bc32692e0d4b8d5cf64eae3d19de987c7375bc9
- type: PACKAGE
  url: https://github.com/zopefoundation/AccessControl
- type: PACKAGE
  url: https://pypi.org/project/accesscontrol
- type: ADVISORY
  url: https://github.com/advisories/GHSA-8xv7-89vj-q48c
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N