CVE-2025-66424CWE-863broken-access-control

CVE-2025-66424

Medium · published November 30, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
14.2
In the wild
Unconfirmed
What it is

Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00239 · 14.2th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-11-30T08:15Z
Affected products (4)
ProductVersionsFixed in
tryton/trytond≥ 6.0.0, < 6.0.706.0.70
tryton/trytond≥ 7.0.0, < 7.0.407.0.40
tryton/trytond≥ 7.4.0, < 7.4.217.4.21
tryton/trytond≥ 7.6.0, < 7.6.117.6.11
References (2)
https://discuss.tryton.org/t/security-release-for-issue-14366/8953 · [email protected]https://foss.heptapod.net/tryton/tryton/-/issues/14366 · [email protected]
EPSS history
Timeline
  • 30 NOV 00:00Z
    Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export
    cvelistv5