trytond vulnerabilities

Latest trytond CVEs

Newest publication first

1. CVE-2025-66423 trytond does not enforce access rights for the route of the HTML editor.

   Published 2025-11-30

   High·CVSS 7.1 EPSS 0.24%

   Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.

2. CVE-2025-66422 trytond allows remote attackers to obtain sensitive trace-back (server setup) information

   Published 2025-11-30

   Medium·CVSS 4.3 EPSS 0.31%

   Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.

3. CVE-2025-66424 trytond does not enforce access rights for data export

   Published 2025-11-30

   Medium·CVSS 6.5 EPSS 0.26%

   Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.

4. CVE-2022-26661 Improper Restriction of XML External Entity Reference in trytond and proteus

   Published 2022-03-07

   Medium·CVSS 6.5 EPSS 1.4%

   An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1....

5. CVE-2022-26662 XML Entity Expansion in trytond and proteus

   Published 2022-03-07

   High·CVSS 7.5 EPSS 2.0%

   An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x a...

6. CVE-2012-2238 trytond Incorrect Authorization vulnerability

   Published 2019-11-21

   High·CVSS 7.5 EPSS 1.8%

   trytond 2.4: ModelView.button fails to validate authorization

7. CVE-2019-10868 Tryton Improper Access Control

   Published 2019-04-05

   Medium·CVSS 6.5 EPSS 1.3%

   In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated user can order records based on a field for which he has no access right. This may allow the user to guess values.

8. CVE-2015-0861 trytond arbitrary fields write via a sequence of records

   Published 2016-04-13

   Medium·CVSS 4.3 EPSS 1.2%

   model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote authenticated users to bypass intended access restrictions and write to arbitrary fields via a sequence of records.

9. CVE-2012-0215 Trytond allows modification of privileges of arbitrary users

   Published 2012-07-12

   Medium·CVSS 5.5 EPSS 2.0%

   model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2) wr...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.