Log in Sign up KO

MEDIUM 6.5

PYSEC-2026-1989

trytond does not enforce access rights for data export

Details

Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.

Are you affected?

Enter the version of the package you're using.

Affected packages

Introduced in: 6.0.0 Fixed in: 6.0.70

Fix pip install --upgrade 'trytond>=6.0.70'

References

https://nvd.nist.gov/vuln/detail/CVE-2025-66424 [ADVISORY]
https://discuss.tryton.org/t/security-release-for-issue-14366/8953 [WEB]
https://foss.heptapod.net/tryton/tryton/-/issues/14366 [WEB]
https://github.com/tryton/trytond [PACKAGE]
https://pypi.org/project/trytond [PACKAGE]
https://github.com/advisories/GHSA-2w93-qwpp-vgvj [ADVISORY]