high7.1
CVE-2025-66423
trytond does not enforce access rights for the route of the HTML editor.
Impact
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | trytond | >= 7.5.0, < 7.6.11 | 7.6.11 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tryton | Trytond | from 6.0.0 before 6.0.70 from 7.0.0 before 7.0.40 from 7.4.0 before 7.4.21 from 7.6.0 before 7.6.11 |