Incorrect authorization in trytond
Priority LOW 31CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.
Summary
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00242 15th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed trytond (Tryton): 6.0.70, 7.0.40, 7.4.21 +1trytond (PyPI): 7.6.11, 7.4.21, 7.0.40 +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Tryton | trytond | 6.0.0 to before 6.0.70; 7.0.0 to before 7.0.40; 7.1.0 to before 7.4.21; 7.5.0 to before 7.6.11 | 6.0.70, 7.0.40, 7.4.21, 7.6.11 | Patch available | CNA |
| — | trytond (PyPI) | 7.5.0 to before 7.6.11 | 7.6.11 | Patch available | GHSA-p3p5-xrmv-4j6x |
| — | trytond (PyPI) | 7.1.0 to before 7.4.21 | 7.4.21 | Patch available | GHSA-p3p5-xrmv-4j6x |
| — | trytond (PyPI) | 7.0.0 to before 7.0.40 | 7.0.40 | Patch available | GHSA-p3p5-xrmv-4j6x |
| — | trytond (PyPI) | 6.0.0 to before 6.0.70 | 6.0.70 | Patch available | GHSA-p3p5-xrmv-4j6x |
- trytond VendorTryton Affected 6.0.0 to before 6.0.70; 7.0.0 to before 7.0.40; 7.1.0 to before 7.4.21; 7.5.0 to before 7.6.11 Fixed in 6.0.70, 7.0.40, 7.4.21, 7.6.11 Patch available CNA
- trytond (PyPI) Vendor— Affected 7.5.0 to before 7.6.11 Fixed in 7.6.11 Patch available GHSA-p3p5-xrmv-4j6x
- trytond (PyPI) Vendor— Affected 7.1.0 to before 7.4.21 Fixed in 7.4.21 Patch available GHSA-p3p5-xrmv-4j6x
- trytond (PyPI) Vendor— Affected 7.0.0 to before 7.0.40 Fixed in 7.0.40 Patch available GHSA-p3p5-xrmv-4j6x
- trytond (PyPI) Vendor— Affected 6.0.0 to before 6.0.70 Fixed in 6.0.70 Patch available GHSA-p3p5-xrmv-4j6x
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:* | 6.0.0 to before 6.0.70; 7.0.0 to before 7.0.40; 7.4.0 to before 7.4.21; 7.6.0 to before 7.6.11 | Vulnerable | Tryton |
- cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:* Versions 6.0.0 to before 6.0.70; 7.0.0 to before 7.0.40; 7.4.0 to before 7.4.21; 7.6.0 to before 7.6.11 Vulnerable ·Tryton
Remediation
- Fix · CNA trytond (Tryton) Fixed in 6.0.70, 7.0.40, 7.4.21, 7.6.11
- Fix · GHSA-p3p5-xrmv-4j6x trytond (PyPI) Fixed in 7.6.11 Advisory →
- Fix · GHSA-p3p5-xrmv-4j6x trytond (PyPI) Fixed in 7.4.21 Advisory →
- Fix · GHSA-p3p5-xrmv-4j6x trytond (PyPI) Fixed in 7.0.40 Advisory →
- Fix · GHSA-p3p5-xrmv-4j6x trytond (PyPI) Fixed in 6.0.70 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Tryton trytond 6.0.70, 7.0.40 and 2 more versions
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2025-40860 Incorrect authorization in trytondPriority LOW 28
- TI-2025-40858 Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back…Priority LOW 20
Timeline
- 2026-10-02 Threatist record created from CVE-2025-66423
- 2026-10-03 Alias added: GHSA-p3p5-xrmv-4j6x
References
More Trytond vulnerabilities
- TI-2022-09935 An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform… CVSS 3.1HIGH 7.5
- TI-2012-01992 trytond 2.4: ModelView.button fails to validate authorization CVSS 3.1HIGH 7.5
- TI-2022-09934 An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45… CVSS 3.1MEDIUM 6.5
- TI-2019-08092 In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6… CVSS 3.1MEDIUM 6.5
- TI-2012-00208 model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for… CVSS 2.0MEDIUM 5.5
- TI-2025-40860 Incorrect authorization in trytond CVSS 3.1MEDIUM 6.5
Sources
- CVE-2025-66423 · CVE Program
- CVE-2025-66423 · NVD
- FIRST EPSS
- GHSA-p3p5-xrmv-4j6x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences