GitHub Advisoryadvisory · PyPI

GHSA-p3p5-xrmv-4j6x trytond does not enforce access rights for the route of the HTML editor.

HIGH Published 2025-11-30 Modified 2025-12-02 Official page ↗
Aliases
CVE-2025-66423
Ecosystem
PyPI
Packages
trytond
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-863
Reviewed
2025-12-02

Affected packages

• PyPI trytond: >= 7.5.0, < 7.6.11 → fixed in 7.6.11 • PyPI trytond: >= 7.1.0, < 7.4.21 → fixed in 7.4.21 • PyPI trytond: >= 7.0.0, < 7.0.40 → fixed in 7.0.40 • PyPI trytond: >= 6.0.0, < 6.0.70 → fixed in 6.0.70

Description

Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.

Related

Alias · CVE (1)

  • CVE-2025-66423 Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References