model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for…
Priority LOW 29CWE-264Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Partial · Partial
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-264.
Summary
model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2) write, (3) delete, or (4) copy rpc call.
Why it matters now
EPSS 0.02021 81st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed trytond (PyPI): 2.4.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | trytond (PyPI) | before 2.4.0 | 2.4.0 | Patch available | GHSA-cqg4-rf29-3mv6 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- trytond (PyPI) Vendor— Affected before 2.4.0 Fixed in 2.4.0 Patch available GHSA-cqg4-rf29-3mv6
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:* | up to 2.2.3 | Vulnerable | Tryton |
| cpe:2.3:a:tryton:trytond:1.4.13:*:*:*:*:*:*:* | 1.4.13 | Vulnerable | Tryton |
| cpe:2.3:a:tryton:trytond:1.6.8:*:*:*:*:*:*:* | 1.6.8 | Vulnerable | Tryton |
| cpe:2.3:a:tryton:trytond:1.8.7:*:*:*:*:*:*:* | 1.8.7 | Vulnerable | Tryton |
| cpe:2.3:a:tryton:trytond:2.0.5:*:*:*:*:*:*:* | 2.0.5 | Vulnerable | Tryton |
- cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:* Versions up to 2.2.3 Vulnerable ·Tryton
- cpe:2.3:a:tryton:trytond:1.4.13:*:*:*:*:*:*:* Versions 1.4.13 Vulnerable ·Tryton
- cpe:2.3:a:tryton:trytond:1.6.8:*:*:*:*:*:*:* Versions 1.6.8 Vulnerable ·Tryton
- cpe:2.3:a:tryton:trytond:1.8.7:*:*:*:*:*:*:* Versions 1.8.7 Vulnerable ·Tryton
- cpe:2.3:a:tryton:trytond:2.0.5:*:*:*:*:*:*:* Versions 2.0.5 Vulnerable ·Tryton
Remediation
- Fix · GHSA-cqg4-rf29-3mv6 trytond (PyPI) Fixed in 2.4.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2012-0215
- 2026-10-03 Alias added: GHSA-cqg4-rf29-3mv6
References
Advisory 3
Other 5
- https://bugs.tryton.org/issue2476
- https://github.com/tryton/trytond/commit/d059ebb792401ded3129cd9402d7392dc34b81e3
- https://github.com/pypa/advisory-database/tree/main/vulns/trytond/PYSEC-2012-6.yaml
- https://github.com/tryton/trytond
- https://web.archive.org/web/20121113201043/http://news.tryton.org/2012/03/security-releases-for-all-supported.html
More Trytond vulnerabilities
- TI-2022-09935 An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform… CVSS 3.1HIGH 7.5
- TI-2012-01992 trytond 2.4: ModelView.button fails to validate authorization CVSS 3.1HIGH 7.5
- TI-2022-09934 An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45… CVSS 3.1MEDIUM 6.5
- TI-2025-40859 Incorrect authorization in trytond CVSS 3.1HIGH 7.1
- TI-2019-08092 In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6… CVSS 3.1MEDIUM 6.5
- TI-2025-40860 Incorrect authorization in trytond CVSS 3.1MEDIUM 6.5
Sources
- CVE-2012-0215 · CVE Program
- CVE-2012-0215 · NVD
- FIRST EPSS
- GHSA-cqg4-rf29-3mv6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences