CVE-2025-66424
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
Risk Assessment
Unauthorized users may export data they do not have permission to access, potentially leading to data confidentiality breaches.
Recommendation
Update Tryton trytond to one of the fixed versions: 7.6.11, 7.4.21, 7.0.40, or 6.0.70.
Other vulnerabilities in Tryton trytond
See all- CVE-2025-66423High
Tryton trytond versions 6.0 through before 7.6.11 do not enforce access rights for the HTML editor route. This is fixed in versions 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
- CVE-2025-66422Medium
Tryton trytond before version 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in versions 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
Original NVD description (English source)
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS