Read the docs
TI-2025-40860 Aliases CVE-2025-66424GHSA-2w93-qwpp-vgvj

Incorrect authorization in trytond

Priority LOW 28CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00257 17th percentileScored 2026-11-07
Fix Fixed trytond (Tryton): 6.0.70, 7.0.40, 7.4.21 +1trytond (PyPI): 7.6.11, 7.4.21, 7.0.40 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Trytontrytond6.0.0 to before 6.0.70; 7.0.0 to before 7.0.40; 7.1.0 to before 7.4.21; 7.5.0 to before 7.6.116.0.70, 7.0.40, 7.4.21, 7.6.11Patch availableCNA
—trytond (PyPI)7.5.0 to before 7.6.117.6.11Patch availableGHSA-2w93-qwpp-vgvj
—trytond (PyPI)7.1.0 to before 7.4.217.4.21Patch availableGHSA-2w93-qwpp-vgvj
—trytond (PyPI)7.0.0 to before 7.0.407.0.40Patch availableGHSA-2w93-qwpp-vgvj
—trytond (PyPI)6.0.0 to before 6.0.706.0.70Patch availableGHSA-2w93-qwpp-vgvj
  • trytond VendorTryton Affected 6.0.0 to before 6.0.70; 7.0.0 to before 7.0.40; 7.1.0 to before 7.4.21; 7.5.0 to before 7.6.11 Fixed in 6.0.70, 7.0.40, 7.4.21, 7.6.11 Patch available CNA
  • trytond (PyPI) Vendor— Affected 7.5.0 to before 7.6.11 Fixed in 7.6.11 Patch available GHSA-2w93-qwpp-vgvj
  • trytond (PyPI) Vendor— Affected 7.1.0 to before 7.4.21 Fixed in 7.4.21 Patch available GHSA-2w93-qwpp-vgvj
  • trytond (PyPI) Vendor— Affected 7.0.0 to before 7.0.40 Fixed in 7.0.40 Patch available GHSA-2w93-qwpp-vgvj
  • trytond (PyPI) Vendor— Affected 6.0.0 to before 6.0.70 Fixed in 6.0.70 Patch available GHSA-2w93-qwpp-vgvj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:*6.0.0 to before 6.0.70; 7.0.0 to before 7.0.40; 7.4.0 to before 7.4.21; 7.6.0 to before 7.6.11VulnerableTryton
  • cpe:2.3:a:tryton:trytond:*:*:*:*:*:*:*:* Versions 6.0.0 to before 6.0.70; 7.0.0 to before 7.0.40; 7.4.0 to before 7.4.21; 7.6.0 to before 7.6.11 Vulnerable ·Tryton

Remediation

  • Fix · CNA trytond (Tryton) Fixed in 6.0.70, 7.0.40, 7.4.21, 7.6.11
  • Fix · GHSA-2w93-qwpp-vgvj trytond (PyPI) Fixed in 7.6.11 Advisory →
  • Fix · GHSA-2w93-qwpp-vgvj trytond (PyPI) Fixed in 7.4.21 Advisory →
  • Fix · GHSA-2w93-qwpp-vgvj trytond (PyPI) Fixed in 7.0.40 Advisory →
  • Fix · GHSA-2w93-qwpp-vgvj trytond (PyPI) Fixed in 6.0.70 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Tryton trytond 6.0.70, 7.0.40 and 2 more versions

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2025-40859 Incorrect authorization in trytondPriority LOW 31
    • TI-2025-40858 Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back…Priority LOW 20
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66424
  2. 2026-10-03 Alias added: GHSA-2w93-qwpp-vgvj

References

Advisory 1

Other 3

  • TI-2022-09935 An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform… CVSS 3.1HIGH 7.5
  • TI-2012-01992 trytond 2.4: ModelView.button fails to validate authorization CVSS 3.1HIGH 7.5
  • TI-2022-09934 An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45… CVSS 3.1MEDIUM 6.5
  • TI-2025-40859 Incorrect authorization in trytond CVSS 3.1HIGH 7.1
  • TI-2019-08092 In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6… CVSS 3.1MEDIUM 6.5
  • TI-2012-00208 model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for… CVSS 2.0MEDIUM 5.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences