CVE-2025-66423
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Tryton trytond versions 6.0 through before 7.6.11 do not enforce access rights for the HTML editor route. This is fixed in versions 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
Risk Assessment
Lack of access rights enforcement may allow unauthorized users to access HTML editor functionality, potentially leading to unauthorized modifications or data leakage.
Recommendation
It is recommended to update trytond to one of the fixed versions (7.6.11, 7.4.21, 7.0.40, or 6.0.70) as soon as possible.
Other vulnerabilities in Tryton trytond
See all- CVE-2025-66424Medium
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
- CVE-2025-66422Medium
Tryton trytond before version 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in versions 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
Original NVD description (English source)
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS