SB2026082592 - Improper access control in Apache Fory

Description

This security bulletin contains information about 1 vulnerability.

1) Improper access control (CVE-ID: CVE-2026-48207)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass deserialization policy restrictions.

The vulnerability exists due to improper access control in ReduceSerializer when deserializing attacker-controlled data during reduce-state restoration and global-name resolution. A remote attacker can supply crafted serialized data to bypass deserialization policy restrictions.

Only applications using PyFory Python-native mode with strict mode disabled and relying on DeserializationPolicy to restrict unsafe classes, functions, or module attributes are vulnerable.

Remediation

Install update from vendor's website.

References

• https://lists.apache.org/api/email.lua?id=yk20nqjbt0y407o252j2v4tkcjf7tj0l
• https://fory.apache.org/security/#cve-2026-48207-pyfory-reduceserializer-deserializationpolicy-bypass