MEDIUM6.5
PYSEC-2026-1989
trytond does not enforce access rights for data export
Quick fix
PYSEC-2026-1989 — trytond: upgrade to the fixed version with the command below.
pip install --upgrade 'trytond>=6.0.70'Details
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-66424[ADVISORY]
- https://discuss.tryton.org/t/security-release-for-issue-14366/8953[WEB]
- https://foss.heptapod.net/tryton/tryton/-/issues/14366[WEB]
- https://github.com/tryton/trytond[PACKAGE]
- https://pypi.org/project/trytond[PACKAGE]
- https://github.com/advisories/GHSA-2w93-qwpp-vgvj[ADVISORY]