~ / search / GHSA-p3p5-xrmv-4j6x

GHSA-p3p5-xrmv-4j6x

trytond does not enforce access rights for the route of the HTML editor.

Source: GitHub Advisory Database (reviewed) High CVE-2025-66423

Packages

EcosystemPackageAffectedFixed in
PyPI trytond >= 7.5.0, < 7.6.11 7.6.11
PyPI trytond >= 7.1.0, < 7.4.21 7.4.21
PyPI trytond >= 7.0.0, < 7.0.40 7.0.40
PyPI trytond >= 6.0.0, < 6.0.70 6.0.70

Details

As written in the advisory (Markdown source, shown as plain text).

Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.

References

External links from the advisory. They lead to third-party sites.