GitHub Advisoryadvisory · PyPI

GHSA-2w93-qwpp-vgvj trytond does not enforce access rights for data export

MEDIUM Published 2025-11-30 Modified 2025-12-02 Official page ↗

Aliases: CVE-2025-66424
Ecosystem: PyPI
Packages: trytond
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-863
Reviewed: 2025-12-02

Affected packages

• PyPI trytond: >= 7.5.0, < 7.6.11 → fixed in 7.6.11 • PyPI trytond: >= 7.1.0, < 7.4.21 → fixed in 7.4.21 • PyPI trytond: >= 7.0.0, < 7.0.40 → fixed in 7.0.40 • PyPI trytond: >= 6.0.0, < 6.0.70 → fixed in 6.0.70

Description

Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.

Alias · CVE (1)

CVE-2025-66424 Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. vulnerability

Weakness · CWE (1)

CWE-863 Incorrect Authorization weakness

References