Executive brief
Tryton trytond is an open-source business management platform that stores sensitive company data including financial records, customer information, and operational details. A flaw in the data export functionality fails to properly check user access permissions, allowing authenticated users to export data they should not have access to. This could lead to exposure of confidential business information, customer records, and financial data.
Technical details
The vulnerability is a missing access control check (CWE-863) in the data export functionality of trytond versions 6.0 through 7.6.10. The export feature fails to enforce record-level access rights that should restrict which data users can retrieve. An authenticated attacker with minimal privileges (login credentials) can exploit this via a network request to export data records they are not authorized to view. The vulnerability requires user authentication and network access to the trytond instance. Patches are available in versions 6.0.70, 7.0.40, 7.4.21, and 7.6.11.
Affected products
- Tryton trytond 6.0.0 through 6.0.69, 7.0.0 through 7.0.39, 7.1.0 through 7.4.20, 7.5.0 through 7.6.10
Timeline
- 2025-11-30: disclosed: GHSA-2w93-qwpp-vgvj and CVE-2025-66424 published
- 2025-11-21: patched: Security release announced with patches for trytond 6.0.70, 7.0.40, 7.4.21, 7.6.11